Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89881— media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是这段 Linux 内核漏洞描述信息的中文翻译： 在 Linux 内核中，已修复以下漏洞： 媒体：rtl2832_sdr：在移除设备时调用 vb2_video_unregister_device() 以修复 DMA 泄漏 在 USB 断开连接时执行，并在任何待处理的流式传输拆解运行之前，将 清除为 NULL。当用户空间随后关闭其文件描述符时，VB2 会调用 ，后者进而调用 。该辅助函数通过以下方式释放每个一致性缓冲区： 当 的 参数为 NULL 时，它会立即返回。因此，在断开连接时仍然处于活动状态的每个 DMA

AI Predicted 5.5 Difficulty: Hard EPSS 0.21% · P10

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 771138920eafa399f68d3492c8a75dfeea23474b< 234c46b95a032232e31fa5987b84fb8f87a9693b affected
771138920eafa399f68d3492c8a75dfeea23474b< 034b6a4f9589c04bc3f2bd5125658cd72d3e17c8 affected
771138920eafa399f68d3492c8a75dfeea23474b< 0ef9f19010ae4ba93aca211ea8f0081b9bf7aab2 affected
771138920eafa399f68d3492c8a75dfeea23474b< 053581d4657c6b5289c5de71a4828d313c005189 affected
771138920eafa399f68d3492c8a75dfeea23474b< bbf15e83c37d9ac938b7c35c02b748fe54230010 affected
771138920eafa399f68d3492c8a75dfeea23474b< 7443b16b6dd8889a3b9c5236a09e7c58f0d11dae affected
771138920eafa399f68d3492c8a75dfeea23474b< a0d9d9a3b41a1346c26af57aade6ba3f552fa171 affected
771138920eafa399f68d3492c8a75dfeea23474b< dabb047c62668f280998e29117c55e41aabac336 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89881

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak rtl2832_sdr_remove() runs on USB disconnect and clears dev->udev to NULL before any pending streaming teardown has run. When user space later closes its file descriptor, vb2 calls rtl2832_sdr_stop_streaming() which in turn calls rtl2832_sdr_free_stream_bufs(). That helper releases each coherent buffer with: usb_free_coherent(dev->udev, dev->buf_size, dev->buf_list[dev->buf_num], dev->dma_addr[dev->buf_num]); usb_free_coherent() returns immediately when its dev argument is NULL, so every DMA stream buffer that was live at disconnect is silently leaked. The URBs allocated in rtl2832_sdr_alloc_urbs() outlive the device for the same reason. The rtl2832_sdr driver uses vb2_fop_release() in its file_operations, so replace video_unregister_device(&dev->vdev) with vb2_video_unregister_device(&dev->vdev) and move it before clearing dev->udev. vb2_video_unregister_device() releases the vb2 queue, which synchronously runs rtl2832_sdr_stop_streaming() if streaming is active, so URBs and coherent DMA stream buffers are freed while dev->udev is still valid. vb2_video_unregister_device() locks vdev->queue->lock (vb_queue_lock) internally, and stop_streaming() locks v4l2_lock, so the previous outer mutex_lock(&dev->vb_queue_lock) / mutex_lock(&dev->v4l2_lock) pair around the unregister sequence would self-deadlock and has been removed. A short v4l2_lock critical section around dev->udev = NULL remains so any ioctl path that still holds the file descriptor sees coherent state. Issue identified by automated review of the INV-003 series at https://sashiko.dev/
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 771138920eafa399f68d3492c8a75dfeea23474b ~ 234c46b95a032232e31fa5987b84fb8f87a9693b -
Linux Linux 3.15 -

II. Public POCs for CVE-2026-89881

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89881

请登录查看更多情报信息。

Other References for CVE-2026-89881 (8)

Same Patch Batch · Linux · 2026-09-16 · 276 CVEs total

CVE-2026-90048 9.8 CRITICAL fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CVE-2026-90012 9.8 CRITICAL spi: Fix DMA mapping ownership on partial map failure
CVE-2026-89970 9.8 CRITICAL nvmet-auth: Synchronize timeout work during SQ teardown
CVE-2026-89857 9.8 CRITICAL scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject
CVE-2026-89969 9.8 CRITICAL nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CVE-2026-89847 9.8 CRITICAL scsi: qla2xxx: Avoid double completion in async IOCB timeout
CVE-2026-89972 9.8 CRITICAL nvme: add missing SRCU grace period in error path
CVE-2026-89990 9.8 CRITICAL ceph: lock mutex in ceph_mds_check_access()
CVE-2026-90036 9.8 CRITICAL NFSD: Prevent client use-after-free during blocked-lock reaping
CVE-2026-90038 9.8 CRITICAL NFSD: Prevent client use-after-free during export state revocation
CVE-2026-90037 9.8 CRITICAL NFSD: Prevent client use-after-free during close_lru reaping
CVE-2026-89788 9.8 CRITICAL ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CVE-2026-89783 9.8 CRITICAL xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CVE-2026-90042 9.8 CRITICAL ceph: properly decrypt filenames in vmalloc() buffers
CVE-2026-89778 9.8 CRITICAL isofs: fix out-of-bounds page array access on empty zisofs block
CVE-2026-89915 9.3 CRITICAL KVM: arm64: Remove VM-wide VNCR mapping counter
CVE-2026-90049 9.3 CRITICAL net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CVE-2026-89775 9.3 CRITICAL KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CVE-2026-89916 9.3 CRITICAL KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry
CVE-2026-89930 9.3 CRITICAL KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

Showing top 20 of 276 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-89881

No comments yet

Leave a comment