CVE-2026-89880: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89880 Overview

CVE-2026-89880 is a resource management vulnerability in the Linux kernel's rtl2832_sdr media driver. The flaw resides in rtl2832_sdr_start_streaming(), which fails to release URBs (USB Request Blocks) and coherent DMA stream buffers when partial allocation or submission errors occur. On subsequent VIDIOC_STREAMON calls, the driver permanently leaks coherent DMA memory and can increment urbs_initialized past MAX_BULK_BUFS, causing rtl2832_sdr_free_urbs() to read past the end of dev->urb_list[] and pass garbage pointers to usb_free_urb().

Critical Impact
A local user with access to the affected DVB-T USB SDR device can trigger memory corruption and DMA memory exhaustion, potentially leading to kernel crash or local privilege escalation.

Affected Products

Linux kernel media/usb/dvb-usb-v2/rtl2832_sdr driver
Multiple stable Linux kernel branches (see referenced commits)
Systems supporting Realtek RTL2832U-based Software Defined Radio USB devices

Discovery Timeline

2026-09-16 - CVE-2026-89880 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89880

Vulnerability Analysis

The vulnerability is a kernel-mode resource leak combined with an out-of-bounds read [CWE-125] in the rtl2832_sdr Software Defined Radio driver. The rtl2832_sdr_start_streaming() function invokes rtl2832_sdr_alloc_stream_bufs(), rtl2832_sdr_alloc_urbs(), and rtl2832_sdr_submit_urbs() sequentially. All three failure paths share a single err: label that only unlocks the driver mutex and returns without releasing previously allocated resources.

When alloc_urbs() succeeds but submit_urbs() fails, or when alloc_urbs() returns -ENOMEM after alloc_stream_bufs() already succeeded, the URBs and coherent DMA buffers remain allocated. The failure is reported to vb2, but the driver state becomes inconsistent for subsequent streaming attempts.

Root Cause

Two latent defects follow on the next VIDIOC_STREAMON ioctl. First, rtl2832_sdr_alloc_stream_bufs() unconditionally resets dev->buf_num to 0 and overwrites dev->buf_list[] and dev->dma_addr[], permanently leaking the previously allocated coherent DMA memory. Second, rtl2832_sdr_alloc_urbs() never resets dev->urbs_initialized and only increments it, allowing the counter to exceed MAX_BULK_BUFS after a second successful pass.

Attack Vector

A local, authenticated user with permission to open the SDR device node can invoke VIDIOC_STREAMON repeatedly under memory pressure to trigger the partial-failure path. On subsequent streaming attempts, rtl2832_sdr_free_urbs() walks from urbs_initialized - 1 down to 0, reading past dev->urb_list[] and passing uninitialized pointers to usb_free_urb(). This can result in kernel memory corruption, denial of service through DMA memory exhaustion, or potential privilege escalation depending on the contents of the adjacent memory.

The fix mirrors the teardown already performed by stop_streaming(): on the error path, rtl2832_sdr_free_urbs() and rtl2832_sdr_free_stream_bufs() are called before unlocking. Both helpers are idempotent, ensuring safety on partial-failure and no-allocation paths.

Detection Methods for CVE-2026-89880

Indicators of Compromise

Kernel oops or panic messages referencing usb_free_urb, rtl2832_sdr_free_urbs, or rtl2832_sdr in dmesg output
Unexplained growth in coherent DMA memory usage visible in /proc/meminfo or /sys/kernel/debug/dma-api/
Repeated VIDIOC_STREAMON failures logged from processes accessing /dev/swradio* device nodes

Detection Strategies

Audit kernel logs for slab corruption or KASAN reports mentioning the rtl2832_sdr module
Monitor process activity for non-root users invoking ioctl() syscalls against DVB or SDR video device nodes
Track loaded kernel module versions against patched baselines using package inventory tooling

Monitoring Recommendations

Enable CONFIG_KASAN and CONFIG_DEBUG_DMA_API in test environments to surface out-of-bounds reads and DMA leaks early
Collect endpoint telemetry on udev events and device node access to detect unauthorized SDR device interaction
Alert on kernel taint flag changes and unexpected module load or unload sequences for rtl2832_sdr

How to Mitigate CVE-2026-89880

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits to all affected systems
Restrict access to SDR and DVB USB device nodes to trusted users only via udev rules or group permissions
Unload the rtl2832_sdr module on systems where the hardware is not required using modprobe -r rtl2832_sdr

Patch Information

The fix is available across multiple stable Linux kernel branches. Relevant commits include Linux Kernel Commit 0337ab0, Linux Kernel Commit 26a2a98, Linux Kernel Commit 8bcf11a, Linux Kernel Commit ac02b2c, Linux Kernel Commit c819dea, Linux Kernel Commit c91e8ae, Linux Kernel Commit f14a713, and Linux Kernel Commit fe50cda. The patch modifies the err: teardown path in rtl2832_sdr_start_streaming() to call rtl2832_sdr_free_urbs() and rtl2832_sdr_free_stream_bufs() before releasing the mutex.

Workarounds

Blacklist the rtl2832_sdr module in /etc/modprobe.d/blacklist.conf where SDR functionality is not required
Physically disconnect Realtek RTL2832U-based USB SDR devices from production hosts until patching is complete
Apply strict user namespace and device cgroup restrictions to containers that expose USB devices to untrusted workloads

bash

# Configuration example
echo "blacklist rtl2832_sdr" | sudo tee /etc/modprobe.d/blacklist-rtl2832_sdr.conf
sudo modprobe -r rtl2832_sdr
sudo update-initramfs -u