CVE-2026-89881

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak

rtl2832_sdr_remove() runs on USB disconnect and clears dev->udev to

NULL before any pending streaming teardown has run. When user space

later closes its file descriptor, vb2 calls rtl2832_sdr_stop_streaming()

which in turn calls rtl2832_sdr_free_stream_bufs(). That helper releases

each coherent buffer with:

usb_free_coherent(dev->udev, dev->buf_size,

dev->buf_list[dev->buf_num],

dev->dma_addr[dev->buf_num]);

usb_free_coherent() returns immediately when its dev argument is NULL,

so every DMA stream buffer that was live at disconnect is silently

leaked. The URBs allocated in rtl2832_sdr_alloc_urbs() outlive the

device for the same reason.

The rtl2832_sdr driver uses vb2_fop_release() in its file_operations,

so replace video_unregister_device(&dev->vdev) with

vb2_video_unregister_device(&dev

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References