CVE-2026-89881 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
rtl2832_sdr_remove() runs on USB disconnect and clears dev->udev to NULL before any pending streaming teardown has run. When user space later closes its file descriptor, vb2 calls rtl2832_sdr_stop_streaming() which in turn calls rtl2832_sdr_free_stream_bufs(). That helper releases each coherent buffer with:
usb_free_coherent(dev->udev, dev->buf_size, dev->buf_list[dev->buf_num],
dev->dma_addr[dev->buf_num]);
usb_free_coherent() returns immediately when its dev argument is NULL, so every DMA stream buffer that was live at disconnect is silently leaked. The URBs allocated in rtl2832_sdr_alloc_urbs() outlive the device for the same reason.
The rtl2832_sdr driver uses vb2_fop_release() in its file_operations, so replace video_unregister_device(&dev->vdev) with vb2_video_unregister_device(&dev->vdev) and move it before clearing dev->udev. vb2_video_unregister_device() releases the vb2 queue, which synchronously runs rtl2832_sdr_stop_streaming() if streaming is active, so URBs and coherent DMA stream buffers are freed while dev->udev is still valid.
vb2_video_unregister_device() locks vdev->queue->lock (vb_queue_lock) internally, and stop_streaming() locks v4l2_lock, so the previous outer mutex_lock(&dev->vb_queue_lock) / mutex_lock(&dev->v4l2_lock) pair around the unregister sequence would self-deadlock and has been removed. A short v4l2_lock critical section around dev->udev = NULL remains so any ioctl path that still holds the file descriptor sees coherent state.
Issue identified by automated review of the INV-003 series at https://sashiko.dev/
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability in the Linux kernel media driver for RTL2832 SDR devices represents a critical resource management flaw rooted in improper sequencing during device removal and USB disconnect events. The core issue arises because the rtl2832_sdr_remove function, which is triggered upon USB disconnection, clears the dev->udev pointer to NULL before ensuring that all pending streaming teardown operations have completed. This premature nullification of the device context creates a dangerous state where subsequent cleanup routines operate on invalid references. When user space applications later close their file descriptors associated with this device, the vb2 framework invokes rtl2832_sdr_stop_streaming(), which subsequently calls rtl2832_sdr_free_stream_bufs(). This helper function attempts to release coherent buffers using usb_free_coherent() by passing dev->udev as a parameter. Since usb_free_coherent() is designed to return immediately if its device argument is NULL, the function silently fails to free any DMA stream buffers that were still active at the time of disconnect. Consequently, every live DMA buffer and associated USB Request Block allocated during streaming operations becomes permanently leaked in kernel memory until system reboot or module reload.
This resource leak directly impacts system stability and security posture by contributing to gradual kernel memory exhaustion over time. In environments where RTL2832-based SDR devices are frequently connected and disconnected, such as in automated testing labs or dynamic radio monitoring setups, these leaks can accumulate rapidly. The accumulation of unreleased coherent DMA buffers and URBs depletes available contiguous physical memory regions required for high-performance I/O operations. This degradation eventually leads to allocation failures for other subsystems relying on similar resources, potentially causing broader system instability or denial of service conditions where legitimate devices cannot be initialized due to lack of sufficient kernel memory reserves. The vulnerability is classified under CWE-401, which describes a missing release of memory after effective lifetime, highlighting the failure to properly deallocate dynamically allocated resources during object destruction sequences.
The operational impact extends beyond simple memory leakage as it also introduces potential race conditions and synchronization issues within the driver's locking mechanisms. The original implementation attempted to protect the unregister sequence with outer mutex locks on both dev->vb_queue_lock and dev->v4l2_lock. However, because vb2_video_unregister_device() internally acquires vdev->queue->lock (which corresponds to vb_queue_lock) and stop_streaming() requires v4l2_lock, retaining these external locks during the unregister process results in self-deadlocks due to lock ordering violations or recursive locking attempts. This structural flaw meant that previous mitigation attempts were either ineffective or introduced new stability risks by blocking critical kernel paths indefinitely. The correct resolution involves replacing video_unregister_device with vb2_video_unregister_device and reordering operations so that device unregistration occurs before clearing the dev->udev pointer. This ensures that vb2 synchronously executes rtl2832_sdr_stop_streaming while the device context remains valid, allowing usb_free_coherent to successfully release all DMA buffers and URBs without encountering null pointers or deadlock conditions.
To mitigate this vulnerability, system administrators should ensure their Linux kernels are updated with patches addressing this specific RTL2832 SDR driver fix. The patch correctly implements vb2_video_unregister_device() prior to setting dev->udev to NULL, thereby guaranteeing that streaming teardown completes successfully while the device structure is still intact. Additionally, the removal of redundant outer mutex locks prevents self-deadlocking scenarios during device unregistration, improving overall system reliability. A minimal critical section around the assignment of dev->udev = NULL remains protected by v4l2_lock to maintain coherent state visibility for any ioctl paths that might still hold file descriptors at the moment of disconnect. This approach aligns with ATT&CK technique T1078, which involves valid accounts and system resources being misused or improperly managed, leading to resource exhaustion. By adhering to proper lifecycle management practices in kernel drivers, such vulnerabilities can be prevented, ensuring robust operation of media subsystem components under dynamic connection scenarios.