CVE-2026-89900: Linux Kernel CEC Core Use-After-Free Flaw

CVE-2026-89900 Overview

CVE-2026-89900 is a memory leak vulnerability in the Linux kernel's Consumer Electronics Control (CEC) core subsystem. The flaw stems from a missed rc_free_device() call within the remote control (rc) device lifecycle. A prior fix for a race condition between rc_unregister_device() and URB/IRQ callbacks (commit dccc0c3ddf8f) removed the implicit rc_free_device() call but left behind a NULL assignment to adap->rc. That leftover assignment prevents cec_delete_adapter() from freeing the allocated rc device, producing a kernel memory leak reported by kmemleak.

Critical Impact
Repeated bind and unbind cycles of CEC-capable drivers such as dw-hdmi leak 4 KB rc device allocations, gradually exhausting kernel memory on long-running systems.

Affected Products

Linux kernel media/cec core subsystem
Drivers using cec_allocate_adapter() including dw_hdmi_cec
Stable kernel branches patched via commits 695063fc, 954ee95a, a24ba065, cca24077, and f28a8e1b

Discovery Timeline

2026-09-16 - CVE-2026-89900 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89900

Vulnerability Analysis

The Linux kernel CEC core allocates a remote control device via rc_allocate_device() during cec_allocate_adapter(). The device pointer is stored in adap->rc for later release by cec_delete_adapter(). Commit dccc0c3ddf8f ("media: rc: fix race between unregister and urb/irq callbacks") restructured teardown so callers must explicitly invoke rc_free_device() after rc_unregister_device(). The CEC core was updated to call rc_unregister_device() but retained the earlier adap->rc = NULL assignment. Once adap->rc is cleared, cec_delete_adapter() skips the free path and the allocated rc device is orphaned.

kmemleak reports 4096-byte unreferenced objects allocated through rc_allocate_device() after unbinding drivers such as dw-hdmi. Every bind and unbind cycle leaks one full rc device structure.

Root Cause

The root cause is an inconsistent teardown sequence introduced during a race-condition fix. Setting adap->rc to NULL before the final release path executes prevents the CEC core from ever calling rc_free_device() on the last user exit. This is a classic memory leak [CWE-401] triggered by lifecycle refactoring that left a stale pointer clear in place.

Attack Vector

The issue is triggered by ordinary driver bind and unbind operations against CEC-capable hardware. It does not require crafted input or network access. Local users or automated device management workflows that repeatedly probe and remove CEC drivers can accumulate leaked allocations, contributing to kernel memory pressure and denial-of-service conditions on long-running hosts.

No exploitation code is required. The vulnerability manifests during normal platform_probe and unbind flows. Refer to the referenced kernel commits for the exact patched code paths.

Detection Methods for CVE-2026-89900

Indicators of Compromise

kmemleak reports referencing rc_allocate_device+0x48/0x2a0 and cec_allocate_adapter in the backtrace
Growth of unreclaimed kmalloc-4k slab objects after repeated CEC driver bind and unbind cycles
Unexplained kernel Slab and SUnreclaim growth in /proc/meminfo on hosts with HDMI CEC hardware

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test kernels and scan /sys/kernel/debug/kmemleak after exercising CEC drivers
Track kernel version and patch status against the fix commits listed in the kernel stable tree
Correlate memory growth with udev events for HDMI or CEC-capable devices in production telemetry

Monitoring Recommendations

Baseline slab memory consumption and alert on sustained growth without corresponding workload increase
Monitor dmesg for kmemleak warnings and CEC subsystem messages tied to driver rebinding
Inventory Linux kernel builds across the fleet and flag hosts running vulnerable pre-patch versions

How to Mitigate CVE-2026-89900

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 695063fc, 954ee95a, a24ba065, cca24077, and f28a8e1b
Update to a stable kernel release that incorporates the CEC core fix removing the adap->rc = NULL assignment
Reboot affected systems after patching to clear previously leaked allocations

Patch Information

The fix removes the stale adap->rc = NULL assignment so that cec_delete_adapter() calls rc_free_device() after the last user of the CEC device exits. Distribution kernel maintainers have backported the change through the linked stable commits: Kernel Commit 695063fc, Kernel Commit 954ee95a, Kernel Commit a24ba065, Kernel Commit cca24077, and Kernel Commit f28a8e1b.

Workarounds

Avoid repeated bind and unbind cycles of CEC-capable drivers such as dw_hdmi_cec on unpatched kernels
Schedule periodic reboots on hosts where CEC hardware cannot be disabled and patching is delayed
Blacklist unused CEC kernel modules on systems that do not require HDMI CEC functionality

bash

# Configuration example: prevent load of CEC driver on unpatched hosts
echo "blacklist dw_hdmi_cec" | sudo tee /etc/modprobe.d/blacklist-cec.conf
sudo update-initramfs -u