CVE-2026-89883 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
media: rc: sunxi-cir: Unregister rc device on probe failure
After rc_register_device() succeeds, later probe failures must undo the registration with rc_unregister_device(). The current error path jumps to the allocation cleanup label and only calls rc_free_device(), leaving the rc device registration and resources created by rc_register_device() behind.
Add a registered-device unwind label for the IRQ lookup, IRQ request, and hardware initialization failure paths. Keep rc_free_device() for failures before rc_register_device() succeeds.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel's media remote control subsystem specifically affects the sunxi-cir driver, which handles infrared reception on Allwinner System-on-Chip platforms. This issue stems from an improper error handling sequence during the device probe phase of the driver initialization process. In standard Linux kernel driver development, when a driver requests system resources such as interrupt lines or registers hardware devices, it must ensure that these resources are properly released if any subsequent step in the initialization fails. The core flaw here is that after the remote control input class device has been successfully registered via rc_register_device(), subsequent failures do not trigger the corresponding unregistration routine. Instead, the error handling logic incorrectly jumps to a cleanup label designed for pre-registration allocations, calling only rc_free_device(). This oversight leaves the kernel's internal data structures and event interfaces associated with the remote control device in an inconsistent state, effectively creating a resource leak within the input subsystem framework.
From a technical perspective, this defect represents a classic case of incomplete teardown during error paths, often categorized under CWE-401 which describes missing release of memory after successful allocation or CWE-756 related to improper use of unvalidated data in complex state machines where cleanup is skipped on failure branches. The rc_register_device function not only allocates memory but also registers the device with the kernel's input subsystem, making it visible to user-space applications and enabling event processing. By failing to call rc_unregister_device upon later probe failures, the driver leaves a dangling reference in the system's device tree for remote controls. This can lead to several operational anomalies including potential use-after-free scenarios if the partially initialized structure is accessed by other kernel components expecting valid state, or simply resource exhaustion over time as repeated failed probes accumulate unreleased entries in the input subsystem's internal lists.
The impact of this vulnerability extends beyond simple memory leaks. It compromises system stability and reliability on affected embedded systems that rely on infrared remote control functionality. If a probe failure occurs after registration but before full initialization is complete, such as during IRQ request or hardware configuration steps, the kernel retains an entry for a device that may never function correctly. This can confuse user-space applications attempting to query available input devices, potentially leading to crashes or undefined behavior when interacting with these phantom devices. Furthermore, in systems where drivers are dynamically loaded and unloaded frequently, this leak contributes to gradual degradation of system performance and increased memory footprint without corresponding functional benefit.
To mitigate this vulnerability, the fix involves restructuring the error handling paths within the sunxi-cir probe function to include a dedicated unwind label for registered device cleanup. This ensures that if rc_register_device succeeds but any subsequent step fails, such as IRQ lookup or hardware initialization errors, the driver correctly calls rc_unregister_device before proceeding to free allocated memory via rc_free_device. Developers should verify that all resource acquisition steps have corresponding release counterparts in every error path of their probe functions. Adhering to this pattern aligns with best practices outlined in industry standards for kernel development and helps prevent similar issues across other drivers within the media subsystem. Regular static analysis using tools like Coccinelle can help identify such asymmetries between resource acquisition and release, ensuring robustness against initialization failures.