CVE-2026-89900

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: cec: core: Fix kmemleak due to missed rc_free_device() call

The commit dccc0c3ddf8f ("media: rc: fix race between unregister and

urb/irq callbacks") removed the implicit call to rc_free_device() from

rc_unregister_device(). However, the commit missed to remove the NULL

assignment of adap->rc that is now causing rc_free_device() to never be

called on an allocated rc device.

kmemleak reports following after e.g. dw-hdmi unbind:

unreferenced object 0xffff00010ac10000 (size 4096):

comm "kworker/u16:1", pid 39, jiffies 4294897739

hex dump (first 32 bytes):

20 23 4b 0a 01 00 ff ff 08 00 c1 0a 01 00 ff ff #K.............

08 00 c1 0a 01 00 ff ff 00 00 00 00 00 00 00 00 ................

backtrace (crc e11baccc):

kmemleak_alloc+0x38/0x44

__kmalloc_cache_noprof+0x4a8/0x5e0

rc_allocate_device+0x48/0x2a0

cec_allocate_adapter+0x3ac/0x800

dw_hdmi_cec_probe+0x264/0x634

platform_probe

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References