In the Linux kernel, the following vulnerability has been resolved:
media: cec: disable delayed work before freeing an interrupted transmit
cec_transmit_msg_fh() drops adap->lock to wait for a blocking transmit in
wait_for_completion_killable(). If that wait is interrupted by a signal,
cancel_delayed_work_sync() can run before the CEC kthread arms the reply
timeout via schedule_delayed_work(&data->work) in cec_transmit_done_ts().
The work is then armed after the cancel, and the data is freed with its
delayed_work still pending:
ODEBUG: free active (active state 0) object: ... hint: cec_wait_timeout
Use disable_delayed_work_sync(): it cancels the work and disables it, so
the later schedule_delayed_work() becomes a no-op and the work cannot be
re-armed. The data is freed right after, so it need not be re-enabled.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The UAF is in cec_transmit_msg_fh(), reached only via the local CEC_TRANSMIT ioctl on /dev/cec* (cec_ioctl to cec_transmit). A CEC peer on the HDMI bus cannot signal-interrupt wait_for_completion_killable(), so this is Local, unlike CEC RX IRQ bugs scored Adjacent.
AC:L - The attacker issues a blocking CEC_TRANSMIT with a reply timeout and signals their own thread so cancel_delayed_work_sync() races the CEC kthread arming data->work in cec_transmit_done_ts(). They control both sides and can retry; syzkaller triggered it.
PR:L - cec_open() defaults to CEC_MODE_INITIATOR, and neither CEC_TRANSMIT nor CEC_ADAP_S_LOG_ADDRS calls capable(). Only raw mode needs CAP_SYS_RAWIO and monitor modes need CAP_NET_ADMIN, neither required here. Unprivileged users with /dev/cec (video group, uaccess, Android HDMI-CEC) can trigger it.
UI:N - The attacker opens /dev/cec, configures logical addresses, issues the blocking transmit ioctl, and delivers a signal to their own process. No separate victim action is required.
S:U - The use-after-free corrupts kernel heap (struct cec_data) in the host kernel. It does not cross a VM, IOMMU, or other separate security authority.
C:H - cec_wait_timeout() runs on a kmalloc'd struct cec_data after kfree(), so a sprayed replacement object yields an attacker-controlled adap pointer and list walks. Per kernel CNA guidance, use-after-free is High confidentiality.
I:H - The delayed-work UAF lets the attacker spray struct cec_data and corrupt list_heads and the adapter mutex when cec_wait_timeout()/cec_data_cancel() run, enabling arbitrary write and control-flow hijack. Per kernel CNA guidance, use-after-free is High integrity.
A:H - Freeing struct cec_data while its delayed_work is still pending causes cec_wait_timeout() to run on freed memory, producing a kernel oops or panic even without a full exploit. Per kernel CNA guidance, use-after-free is High availability.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The UAF is in cec_transmit_msg_fh(), reached only via the local CEC_TRANSMIT ioctl on /dev/cec* (cec_ioctl to cec_transmit). A CEC peer on the HDMI bus cannot signal-interrupt wait_for_completion_killable(), so this is Local, unlike CEC RX IRQ bugs scored Adjacent.
AC:L - The attacker issues a blocking CEC_TRANSMIT with a reply timeout and signals their own thread so cancel_delayed_work_sync() races the CEC kthread arming data->work in cec_transmit_done_ts(). They control both sides and can retry; syzkaller triggered it.
PR:L - cec_open() defaults to CEC_MODE_INITIATOR, and neither CEC_TRANSMIT nor CEC_ADAP_S_LOG_ADDRS calls capable(). Only raw mode needs CAP_SYS_RAWIO and monitor modes need CAP_NET_ADMIN, neither required here. Unprivileged users with /dev/cec (video group, uaccess, Android HDMI-CEC) can trigger it.
UI:N - The attacker opens /dev/cec, configures logical addresses, issues the blocking transmit ioctl, and delivers a signal to their own process. No separate victim action is required.
S:U - The use-after-free corrupts kernel heap (struct cec_data) in the host kernel. It does not cross a VM, IOMMU, or other separate security authority.
C:H - cec_wait_timeout() runs on a kmalloc'd struct cec_data after kfree(), so a sprayed replacement object yields an attacker-controlled adap pointer and list walks. Per kernel CNA guidance, use-after-free is High confidentiality.
I:H - The delayed-work UAF lets the attacker spray struct cec_data and corrupt list_heads and the adapter mutex when cec_wait_timeout()/cec_data_cancel() run, enabling arbitrary write and control-flow hijack. Per kernel CNA guidance, use-after-free is High integrity.
A:H - Freeing struct cec_data while its delayed_work is still pending causes cec_wait_timeout() to run on freed memory, producing a kernel oops or panic even without a full exploit. Per kernel CNA guidance, use-after-free is High availability.
CVSS 3.1