CVE-2026-89883: media: rc: sunxi-cir: Unregister rc device on probe failure
In the Linux kernel, the following vulnerability has been resolved:
media: rc: sunxi-cir: Unregister rc device on probe failure
After rcregisterdevice() succeeds, later probe failures must undo the registration with rcunregisterdevice(). The current error path jumps to the allocation cleanup label and only calls rcfreedevice(), leaving the rc device registration and resources created by rcregisterdevice() behind.
Add a registered-device unwind label for the IRQ lookup, IRQ request, and hardware initialization failure paths. Keep rcfreedevice() for failures before rcregisterdevice() succeeds.
Event History
Frequently Asked Questions
When can the leaked registered rc device occur?
It occurs only when rc_register_device() has already succeeded and a later probe step fails. The affected later failures are IRQ lookup, IRQ request, and hardware initialization failures.
What is the impact of the faulty error path?
The error path calls rc_free_device() without first unregistering the rc device. This leaves the rc device registration and resources created by rc_register_device() behind.
What behavior should a corrected driver have on these probe failures?
For failures after successful rc_register_device(), the driver must call rc_unregister_device() to unwind the registration. rc_free_device() remains appropriate for failures that occur before registration succeeds.