UBUNTU-CVE-2026-89900: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: media: cec: core: Fix kmemleak due to missed rcfreedevice() call The commit dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks") removed the implicit call to rcfreedevice() from rcunregisterdevice(). However, the commit missed to remove the NULL assignment of adap->rc that is now causing rcfreedevice() to never be called on an allocated rc device. kmemleak reports following after e.g. dw-hdmi unbind: unreferenced object 0xffff00010ac10000 (size 4096): comm "kworker/u16:1", pid 39, jiffies 4294897739 hex dump (first 32 bytes): 20 23 4b 0a 01 00 ff ff 08 00 c1 0a 01 00 ff ff #K............. 08 00 c1 0a 01 00 ff ff 00 00 00 00 00 00 00 00 ................ backtrace (crc e11baccc): kmemleakalloc+0x38/0x44 kmalloccachenoprof+0x4a8/0x5e0 rcallocatedevice+0x48/0x2a0 cecallocateadapter+0x3ac/0x800 dwhdmicecprobe+0x264/0x634 platformprobe+0xc0/0x188 reallyprobe+0x4a4/0x8e0 driverprobedevice+0x2f8/0x440 driverprobedevice+0x60/0x160 deviceattachdriver+0x1a0/0x2a0 busforeachdrv+0x100/0x1a0 deviceattach+0x174/0x350 deviceinitialprobe+0x90/0xb0 busprobedevice+0x4c/0x120 deviceadd+0xdec/0x116c platformdeviceadd+0x354/0x598 Remove the assignment of adap->rc to NULL to let cecdeleteadapter() free the allocated rc device after last user of the cec device exits to fix the kmemleak.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1069.74~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1073.82~22.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1071.78~22.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1073.81~22.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-1069.70~22.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-6.8to a version that resolves this vulnerability.Fixed in 6.8.0-149.149.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-realtime-6.8to a version that resolves this vulnerability.Fixed in 6.8.1-1064.65~22.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-149.149 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1069.74 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1073.82 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1073.81 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1068.77 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1053.57 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1069.70 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-149.149.1 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 6.8.0-1067.70 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1067.71 - Upgrade
Upgrade
ubuntu/linux-vmwareto a version that resolves this vulnerability.Fixed in 6.8.0-1010.10 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1036.41 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1064.65 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1069.74+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1073.82+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1073.81+fips1 - Configuration
Remove the assignment of adap->rc to NULL so cec_delete_adapter() frees the allocated rc device after the last user of the CEC device exits.
Linux kernel media CEC core adap->rc assignment = removed
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
The issue is associated with the Linux kernel CEC core and is demonstrated when a DW-HDMI CEC device is unbound. Systems using affected Ubuntu kernel packages with CEC adapters and drivers that allocate an RC device are the relevant exposure set.
What is the practical impact of triggering the flaw?
The missed rc_free_device() call leaves an allocated RC device unreleased, resulting in a kernel memory leak detectable by kmemleak. The provided information describes a resource-leak condition rather than code execution or privilege escalation.
How can an administrator identify whether the issue has occurred?
kmemleak can report an unreferenced allocation whose stack trace includes rc_allocate_device(), cec_allocate_adapter(), and dw_hdmi_cec_probe(). The example indicates this may be observed after unbinding DW-HDMI.