The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: media: ti: vpe: quiesce overflow     recovery before freeing streams The VIP overflow recovery worker is armed from the hardirq handler when a     FIFO overflow is detected, and the list-complete path looks the stream up through the VPDMA list private     pointer. Both keep touching stream, port and device state; the recovery worker also resets the parser and     VPDMA, repopulates the descriptor list, and re-enables the per-list IRQs. vip_stop_streaming() masks and     clears the per-list IRQs, but it neither synchronizes the hardirq handler nor disables recovery_work. An     overflow IRQ that has already queued recovery_work, or a list-complete IRQ in flight when the stream is     torn down, can therefore still dereference the stream after its resources are released: the descriptor     list is freed by vip_release_stream() on file release, and the stream itself by free_stream() on     unbind/remove. Drain the recovery worker and the IRQ handler at both teardown points through a shared     vip_quiesce_stream() helper, before any stream-owned resource is released. disable_work_sync() cancels     pending recovery_work, drains a running instance, and raises its disable depth, so a subsequent     schedule_work() issued by a racing IRQ handler is rejected at the workqueue scheduler: recovery_work     cannot be requeued after disable_work_sync() takes effect. The worker may still re-enable the per-list     IRQs before disable_work_sync() returns; disable_irqs() then masks those sources and synchronize_irq()     waits for any in-flight handler that still dereferences stream state. In vip_stop_streaming() the helper     runs before the parser is stopped, since a worker drained by disable_work_sync() may re-enable the parser     before exiting and would otherwise undo the stop. recovery_work is created disabled and enabled in     vip_start_streaming() before IRQs, pairing the enable with the teardown disable across the streaming     lifecycle. This issue was found by an in-house static analysis tool and confirmed by manual code review.
    (CVE-2026-89875)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
346493	Linux Distros Unpatched Vulnerability : CVE-2026-89875	Nessus	Misc.	9/16/2026	11/11/2026	high
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	11/5/2026	11/5/2026	high

Detections

Analytics

Plugins Search

high

high