CVE-2026-68214: media: rtl2832: fix use-after-free in rtl2832_remove()
In the Linux kernel, the following vulnerability has been resolved:
media: rtl2832: fix use-after-free in rtl2832remove()
canceldelayedworksync() is called before i2cmuxdeladapters() in rtl2832remove(). While the cancel waits for any running instance of i2cgatework to finish, it does not prevent the timer from being rescheduled by a concurrent thread.
During probe, the r820tattach() call attempts I2C transfers through the mux adapter. These transfers go through i2cmuxmasterxfer(), which calls rtl2832deselect() after the transfer completes, rescheduling i2cgatework via scheduledelayedwork(). If this transfer is still in flight when rtl2832remove() runs, rtl2832deselect() can reschedule i2cgatework after it has been cancelled, causing a use-after-free when kfree(dev) is called.
Fix this by calling i2cmuxdeladapters() before canceldelayedworksync(). Once the mux adapter is unregistered, no new I2C transfers can go through it, so rtl2832deselect() can no longer reschedule i2cgatework. The subsequent canceldelayedworksync() is then guaranteed to be final.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the driver by calling i2c_mux_del_adapters() before the r820t_attach() call attempts I2C transfers through the mux adapter (to prevent I2C transfers going through i2c_mux_master_xfer() after mux adapter unregistration).
Linux kernel media driver rtl2832 i2c_mux_del_adapters() call order = Call i2c_mux_del_adapters() before r820t_attach() attempts I2C transfers - Configuration
In rtl2832_remove(), ensure cancel_delayed_work_sync() is called before i2c_mux_del_adapters() so the delayed work is not rescheduled concurrently and to prevent use-after-free when kfree(dev) is called.
Linux kernel rtl2832 driver cancel_delayed_work_sync() placement = Call cancel_delayed_work_sync() before i2c_mux_del_adapters()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68214?
CVE-2026-68214 has a risk score of 44, indicating a significant security vulnerability in the Linux kernel.
What does CVE-2026-68214 involve?
CVE-2026-68214 involves a use-after-free vulnerability in the rtl2832_remove() function of the Linux kernel.
How do I fix CVE-2026-68214?
To fix CVE-2026-68214, update your Linux kernel to the latest version where the vulnerability has been addressed.
What systems are affected by CVE-2026-68214?
CVE-2026-68214 affects systems running specific versions of the Linux kernel that utilize the rtl2832 media drivers.
What is the primary function impacted by CVE-2026-68214?
CVE-2026-68214 primarily impacts the rtl2832_remove() function, which is responsible for handling the rtl2832 media device removal.