media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-89881
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-16 11:16:56 UTC
Updated2026-09-16 11:16:56 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak rtl2832_sdr_remove() runs on USB disconnect and clears dev->udev to NULL before any pending streaming teardown has run. When user space later closes its file descriptor, vb2 calls rtl2832_sdr_stop_streaming() which in turn calls rtl2832_sdr_free_stream_bufs(). That helper releases each coherent buffer with: usb_free_coherent(dev->udev, dev->buf_size, dev->buf_list[dev->buf_num], dev->dma_addr[dev->buf_num]); usb_free_coherent() returns immediately when its dev argument is NULL, so every DMA stream buffer that was live at disconnect is silently leaked. The URBs allocated in rtl2832_sdr_alloc_urbs() outlive the device for the same reason. The rtl2832_sdr driver uses vb2_fop_release() in its file_operations, so replace video_unregister_device(&dev->vdev) with vb2_video_unregister_device(&dev->vdev) and move it before clearing dev->udev. vb2_video_unregister_device() releases the vb2 queue, which synchronously runs rtl2832_sdr_stop_streaming() if streaming is active, so URBs and coherent DMA stream buffers are freed while dev->udev is still valid. vb2_video_unregister_device() locks vdev->queue->lock (vb_queue_lock) internally, and stop_streaming() locks v4l2_lock, so the previous outer mutex_lock(&dev->vb_queue_lock) / mutex_lock(&dev->v4l2_lock) pair around the unregister sequence would self-deadlock and has been removed. A short v4l2_lock critical section around dev->udev = NULL remains so any ioctl path that still holds the file descriptor sees coherent state. Issue identified by automated review of the INV-003 series at https://sashiko.dev/

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 771138920eafa399f68d3492c8a75dfeea23474b 234c46b95a032232e31fa5987b84fb8f87a9693b git Not specified
CNA Linux Linux affected 771138920eafa399f68d3492c8a75dfeea23474b 034b6a4f9589c04bc3f2bd5125658cd72d3e17c8 git Not specified
CNA Linux Linux affected 771138920eafa399f68d3492c8a75dfeea23474b 0ef9f19010ae4ba93aca211ea8f0081b9bf7aab2 git Not specified
CNA Linux Linux affected 771138920eafa399f68d3492c8a75dfeea23474b 053581d4657c6b5289c5de71a4828d313c005189 git Not specified
CNA Linux Linux affected 771138920eafa399f68d3492c8a75dfeea23474b bbf15e83c37d9ac938b7c35c02b748fe54230010 git Not specified
CNA Linux Linux affected 771138920eafa399f68d3492c8a75dfeea23474b 7443b16b6dd8889a3b9c5236a09e7c58f0d11dae git Not specified
CNA Linux Linux affected 771138920eafa399f68d3492c8a75dfeea23474b a0d9d9a3b41a1346c26af57aade6ba3f552fa171 git Not specified
CNA Linux Linux affected 771138920eafa399f68d3492c8a75dfeea23474b dabb047c62668f280998e29117c55e41aabac336 git Not specified
CNA Linux Linux affected 3.15 Not specified
CNA Linux Linux unaffected 3.15 semver Not specified
CNA Linux Linux unaffected 5.10.270 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.221 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.188 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.157 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.110 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.51 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.5 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/053581d4657c6b5289c5de71a4828d313c005189 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/7443b16b6dd8889a3b9c5236a09e7c58f0d11dae 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/dabb047c62668f280998e29117c55e41aabac336 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/034b6a4f9589c04bc3f2bd5125658cd72d3e17c8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a0d9d9a3b41a1346c26af57aade6ba3f552fa171 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/bbf15e83c37d9ac938b7c35c02b748fe54230010 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/234c46b95a032232e31fa5987b84fb8f87a9693b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0ef9f19010ae4ba93aca211ea8f0081b9bf7aab2 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report