CVE-2026-68213: Linux Kernel Information Disclosure Flaw

CVE-2026-68213 Overview

CVE-2026-68213 is a memory leak vulnerability in the Linux kernel's rtl2832_sdr media driver. The flaw resides in rtl2832_sdr_start_streaming(), which fails to return queued buffers to the videobuf2 (vb2) framework when its error paths trigger. When start_streaming() returns an error without calling vb2_buffer_done() on previously queued buffers, the vb2 framework fires WARN_ON(owned_by_drv_count) and the queued buffers leak.

Critical Impact
A local attacker with access to the SDR device can repeatedly trigger error paths in rtl2832_sdr_start_streaming() to leak kernel memory buffers and destabilize the media subsystem.

Affected Products

Linux kernel builds shipping the rtl2832_sdr media driver
Distributions consuming stable kernel branches prior to the referenced fix commits
Systems exposing Realtek RTL2832-based SDR USB adapters to unprivileged users

Discovery Timeline

2026-08-10 - CVE-2026-68213 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68213

Vulnerability Analysis

The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). The driver contract requires that if start_streaming() returns an error, the driver must first return queued buffers via vb2_buffer_done(). Failure to do so causes the vb2 core to trigger WARN_ON(owned_by_drv_count) and leaks the queued buffers.

The rtl2832_sdr_start_streaming() function contained multiple error paths that violated this contract. Two direct early returns handled -ENODEV and -ERESTARTSYS. Six additional goto err paths covered failures in subdev s_power, tuner setup, ADC setup, stream-buffer allocation, URB allocation, and URB submission. None of these paths returned the queued buffers.

The fix mirrors the earlier uvcvideo remediation in commit 4cf3b6fd54eb. It introduces rtl2832_sdr_cleanup_queued_bufs(), which accepts a vb2_buffer_state argument. Error paths pass VB2_BUF_STATE_QUEUED as expected by userspace on start_streaming() failure, while stop_streaming() retains its existing VB2_BUF_STATE_ERROR semantics.

Root Cause

The original function lacked a distinct success exit and fell through into the err label, which only performed mutex_unlock and returned an error code. Adding cleanup at err required pairing it with an explicit success return. Otherwise, every successful start would drain the buffer queue and terminate streaming. The absence of vb2_buffer_done() calls across all error paths is the root cause of the leak.

Attack Vector

Exploitation requires local access to the SDR device node exposed by the driver. An attacker with sufficient permissions to open the device can repeatedly initiate streaming and force a failure in one of the vulnerable error paths. Each failure leaks the queued buffers held by the driver, producing memory exhaustion and kernel warnings over time.

Note: the err label still does not roll back power_ctrl(), frontend_ctrl(), the POWER_ON flag, or stream and URB allocations that occurred before the failing step. These are pre-existing leaks of a different class and are not addressed by this fix.

Detection Methods for CVE-2026-68213

Indicators of Compromise

Kernel log entries containing WARN_ON(owned_by_drv_count) originating from the vb2 core following an SDR streaming attempt.
Repeated failed VIDIOC_STREAMON ioctl calls against /dev/swradio* device nodes from unprivileged processes.
Growth in kernel slab allocations tied to vb2 buffer structures without matching frees.

Detection Strategies

Monitor dmesg and journalctl -k for vb2 driver-owned buffer warnings correlated with the rtl2832_sdr module.
Audit process activity that opens SDR character devices and enumerate loaded kernel modules on affected hosts using lsmod | grep rtl2832_sdr.
Track kernel memory pressure and buffer pool statistics via /proc/slabinfo for anomalous growth in videobuf2 allocations.

Monitoring Recommendations

Alert on unexpected kernel WARN traces referencing vb2_start_streaming on production Linux endpoints.
Restrict and log access to /dev/swradio* and related media device nodes through udev rules and auditd.
Track kernel version inventory to identify hosts still running unpatched rtl2832_sdr builds.

How to Mitigate CVE-2026-68213

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the kernel.org commits 0b08c0403cf, 33ca0aab6f4, 465dc8e71d2, 894e83509c6, and fc0b18782aa.
Restrict access to SDR device nodes to trusted users using group ownership and udev policies.
Unload the rtl2832_sdr module on systems that do not require SDR functionality.

Patch Information

The fix adds rtl2832_sdr_cleanup_queued_bufs() invocations at the err label and before each early return in rtl2832_sdr_start_streaming(), along with an explicit success return path. Patches are available across stable branches. See the Kernel Git Commit 0b08c0403cf, Kernel Git Commit 33ca0aab6f4, Kernel Git Commit 465dc8e71d2, Kernel Git Commit 894e83509c6, and Kernel Git Commit fc0b18782aa for the full changesets.

Workarounds

Blacklist the rtl2832_sdr module in /etc/modprobe.d/ where SDR hardware is not in use.
Enforce strict permissions on /dev/swradio* nodes to prevent unprivileged access.
Physically remove or disable RTL2832-based USB adapters on systems that cannot be patched immediately.

bash

# Configuration example
echo 'blacklist rtl2832_sdr' | sudo tee /etc/modprobe.d/blacklist-rtl2832_sdr.conf
sudo depmod -a
sudo modprobe -r rtl2832_sdr 2>/dev/null || true