CVE-2026-89881: In the Linux kernel, the following vulnerability has been resolved: media: rtl2832_sdr: use vb2_video_unregister_device
Summary
A vulnerability in the Linux kernel's rtl2832_sdr driver caused DMA memory leaks (memory allocated for direct hardware access that wasn't being freed) when USB devices disconnected. The problem occurred because the device reference was cleared before pending data transfers finished, causing subsequent cleanup calls to fail silently when they tried to free the allocated memory.
Solution / Mitigation
Replace video_unregister_device(&dev->vdev) with vb2_video_unregister_device(&dev->vdev) (a function that properly manages video buffer cleanup) and move it before clearing dev->udev. This ensures that pending streaming operations complete and memory is freed while the device reference is still valid. Additionally, remove the outer mutex locks around the unregister sequence and keep only a short critical section around dev->udev = NULL to prevent deadlocks.
Vulnerability Details
EPSS: 0.0%
September 16, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-89881
First tracked: September 16, 2026 at 08:08 AM
Classified by LLM (prompt v3) · confidence: 95%