CVE-2026-89900: media: cec: core: Fix kmemleak due to missed rc_free_device() call
In the Linux kernel, the following vulnerability has been resolved:
media: cec: core: Fix kmemleak due to missed rcfreedevice() call
The commit dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks") removed the implicit call to rcfreedevice() from rcunregisterdevice(). However, the commit missed to remove the NULL assignment of adap->rc that is now causing rcfreedevice() to never be called on an allocated rc device.
kmemleak reports following after e.g. dw-hdmi unbind:
unreferenced object 0xffff00010ac10000 (size 4096): comm "kworker/u16:1", pid 39, jiffies 4294897739 hex dump (first 32 bytes): 20 23 4b 0a 01 00 ff ff 08 00 c1 0a 01 00 ff ff #K............. 08 00 c1 0a 01 00 ff ff 00 00 00 00 00 00 00 00 ................ backtrace (crc e11baccc): kmemleakalloc+0x38/0x44 kmalloccachenoprof+0x4a8/0x5e0 rcallocatedevice+0x48/0x2a0 cecallocateadapter+0x3ac/0x800 dwhdmicecprobe+0x264/0x634 platformprobe+0xc0/0x188 reallyprobe+0x4a4/0x8e0 driverprobedevice+0x2f8/0x440 driverprobedevice+0x60/0x160 deviceattachdriver+0x1a0/0x2a0 busforeachdrv+0x100/0x1a0 deviceattach+0x174/0x350 deviceinitialprobe+0x90/0xb0 busprobedevice+0x4c/0x120 deviceadd+0xdec/0x116c platformdeviceadd+0x354/0x598
Remove the assignment of adap->rc to NULL to let cecdeleteadapter() free the allocated rc device after last user of the cec device exits to fix the kmemleak.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch dccc0c3ddf8f
Event History
Frequently Asked Questions
What system activity triggers the leak?
The leak occurs when a CEC adapter has allocated an RC device and is later unbound or unregistered. The report gives a dw-hdmi unbind as an example trigger.
How can I determine whether the issue is occurring?
kmemleak can report an unreferenced 4096-byte object allocated through rc_allocate_device(), with a backtrace including cec_allocate_adapter() and, in the example, dw_hdmi_cec_probe().
What is the remediation?
Apply the resolved Linux kernel fix referenced by the listed stable commits. The correction ensures rc_free_device() is reached rather than clearing adap->rc before the RC device can be freed.