CVE-2026-68214media: rtl2832: fix use-after-free in rtl2832_remove()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: rtl2832: fix use-after-free in rtl2832_remove() cancel_delayed_work_sync() is called before i2c_mux_del_adapters() in rtl2832_remove(). While the cancel waits for any running instance of i2c_gate_work to finish, it does not prevent the timer from being rescheduled by a concurrent thread. During probe, the r820t_attach() call attempts I2C transfers through the mux adapter. These transfers go through i2c_mux_master_xfer(), which calls rtl2832_deselect() after the transfer completes, rescheduling i2c_gate_work via schedule_delayed_work(). If this transfer is still in flight when rtl2832_remove() runs, rtl2832_deselect() can reschedule i2c_gate_work after it has been cancelled, causing a use-after-free when kfree(dev) is called. Fix this by calling i2c_mux_del_adapters() before cancel_delayed_work_sync(). Once the mux adapter is unregistered, no new I2C transfers can go through it, so rtl2832_deselect() can no longer reschedule i2c_gate_work. The subsequent cancel_delayed_work_sync() is then guaranteed to be final.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from cddcc40b1b1553010acb89add84c64b5d123ec94 before 1e8a6bc19403661661fed5ae82f6eca6c9cdfad2; from cddcc40b1b1553010acb89add84c64b5d123ec94 before 68a9c0290897c1436ddceb8cea604c93377a0299; from cddcc40b1b1553010acb89add84c64b5d123ec94 before 13c06056699e66ff7109ba68658cc6ea4a23f516; from cddcc40b1b1553010acb89add84c64b5d123ec94 before 9acd5bbbe1df8e487e49488692c224496d4c9e16; from cddcc40b1b1553010acb89add84c64b5d123ec94 before 24bef237eef8dd1ebcffb129ba21891ddad0d309; from cddcc40b1b1553010acb89add84c64b5d123ec94 before 2c71bda6edc630a1f8c3c45d8df5fc22d234e042; from cddcc40b1b1553010acb89add84c64b5d123ec94 before 90d781711418881f8c836c2a859cc2886625d750; from cddcc40b1b1553010acb89add84c64b5d123ec94 before 680daf40a82d483949f87f0d8f98639dc47e610c | CNA record |
References
- https://git.kernel.org/stable/c/1e8a6bc19403661661fed5ae82f6eca6c9cdfad2
- https://git.kernel.org/stable/c/68a9c0290897c1436ddceb8cea604c93377a0299
- https://git.kernel.org/stable/c/13c06056699e66ff7109ba68658cc6ea4a23f516
- https://git.kernel.org/stable/c/9acd5bbbe1df8e487e49488692c224496d4c9e16
- https://git.kernel.org/stable/c/24bef237eef8dd1ebcffb129ba21891ddad0d309
- https://git.kernel.org/stable/c/2c71bda6edc630a1f8c3c45d8df5fc22d234e042
- https://git.kernel.org/stable/c/90d781711418881f8c836c2a859cc2886625d750
- https://git.kernel.org/stable/c/680daf40a82d483949f87f0d8f98639dc47e610c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.