CVE-2026-89881: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89881 Overview

CVE-2026-89881 is a memory leak vulnerability in the Linux kernel's rtl2832_sdr media driver. The flaw affects the USB disconnect path for Realtek RTL2832-based software-defined radio devices. When a user unplugs the device while streaming is active, the driver clears dev->udev to NULL before pending videobuf2 (vb2) teardown runs. This causes usb_free_coherent() to silently drop every live DMA stream buffer and any outstanding USB Request Blocks (URBs), leaking coherent DMA memory for the lifetime of the system.

Critical Impact
Local attackers with physical access to a USB SDR device can trigger repeated coherent DMA memory leaks by disconnecting the device during active streaming, degrading kernel memory availability over time.

Affected Products

Linux kernel media subsystem, rtl2832_sdr driver
Systems using Realtek RTL2832U-based USB software-defined radio dongles
Multiple stable kernel branches receiving backports across eight referenced commits

Discovery Timeline

2026-09-16 - CVE-2026-89881 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89881

Vulnerability Analysis

The vulnerability is a memory leak [CWE-401] triggered by an ordering error between USB disconnect handling and vb2 streaming teardown. The rtl2832_sdr_remove() function runs on USB disconnect and sets dev->udev = NULL before the video device is unregistered. Any streaming session still holding a file descriptor completes its teardown asynchronously, after the USB device pointer has already been cleared.

When user space subsequently closes its file descriptor, vb2 invokes rtl2832_sdr_stop_streaming(), which calls rtl2832_sdr_free_stream_bufs(). That helper passes dev->udev to usb_free_coherent() to release each coherent DMA buffer. Because usb_free_coherent() returns immediately when its dev argument is NULL, every DMA stream buffer that was live at disconnect is silently leaked. The URBs allocated in rtl2832_sdr_alloc_urbs() outlive the device for the same reason.

Root Cause

The root cause is the use of video_unregister_device() rather than vb2_video_unregister_device() in the remove path, combined with premature nulling of dev->udev. Because the driver already uses vb2_fop_release() in its file_operations, the vb2 queue is the correct owner of streaming teardown and must run synchronously against a valid USB device pointer.

Attack Vector

Exploitation requires local physical access to abruptly disconnect a USB SDR device while it is streaming. Repeated disconnect cycles accumulate leaked coherent DMA memory, which is a scarce kernel resource, ultimately contributing to a denial-of-service condition through resource exhaustion.

The fix replaces video_unregister_device(&dev->vdev) with vb2_video_unregister_device(&dev->vdev) and moves the call before clearing dev->udev. vb2_video_unregister_device() releases the vb2 queue, which synchronously runs rtl2832_sdr_stop_streaming() when streaming is active, so URBs and coherent DMA buffers are freed while dev->udev is still valid. The prior outer mutex_lock(&dev->vb_queue_lock) and mutex_lock(&dev->v4l2_lock) pair around the unregister sequence was removed to prevent self-deadlock, because vb2_video_unregister_device() internally locks vdev->queue->lock and stop_streaming() locks v4l2_lock. A short v4l2_lock critical section around dev->udev = NULL remains so any ioctl path holding the file descriptor sees coherent state.

Detection Methods for CVE-2026-89881

Indicators of Compromise

Growing CmaTotal versus CmaFree gap or steadily rising DMA allocations in /proc/meminfo on systems with attached RTL2832 SDR hardware
Kernel log entries showing repeated rtl2832_sdr bind and unbind cycles without matching buffer release messages
Increasing slab and coherent DMA pool usage on hosts running SDR workloads such as rtl_sdr, gqrx, or SDR# over USB passthrough

Detection Strategies

Audit kernel version and rtl2832_sdr module presence with modinfo rtl2832_sdr and compare against patched stable branches referenced by kernel commits 034b6a4, 053581d, 0ef9f19, 234c46b, 7443b16, a0d9d9a, bbf15e8, and dabb047
Monitor for unexpected USB device disconnect events during active V4L2 streaming using udev and dmesg correlation

Monitoring Recommendations

Track coherent DMA pool utilization over time on any host that exposes RTL2832 USB SDR devices to users or virtual machines
Alert on kernel out-of-memory conditions that reference DMA or coherent allocations on systems where SDR drivers are loaded

How to Mitigate CVE-2026-89881

Immediate Actions Required

Update to a Linux kernel release that includes the fixes referenced in the kernel.org stable commits for the rtl2832_sdr driver
Unload the rtl2832_sdr module on systems that do not use software-defined radio hardware to eliminate exposure
Restrict physical and USB passthrough access to RTL2832-based devices on multi-tenant or shared hosts

Patch Information

The fix is committed across multiple stable kernel branches. Refer to the following patches: Kernel Commit 034b6a4, Kernel Commit 053581d, Kernel Commit 0ef9f19, Kernel Commit 234c46b, Kernel Commit 7443b16, Kernel Commit a0d9d9a, Kernel Commit bbf15e8, and Kernel Commit dabb047.

Workarounds

Blacklist the rtl2832_sdr module in /etc/modprobe.d/ on hosts that do not require SDR functionality
Disable USB passthrough of RTL2832 devices to guest virtual machines until the host kernel is patched
Instruct users to stop active streaming sessions before physically disconnecting SDR hardware to reduce leak frequency

bash

# Blacklist the vulnerable module until the kernel is patched
echo 'blacklist rtl2832_sdr' | sudo tee /etc/modprobe.d/blacklist-rtl2832_sdr.conf
sudo rmmod rtl2832_sdr 2>/dev/null || true
sudo update-initramfs -u