CVE-2026-89880

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure

rtl2832_sdr_start_streaming() calls rtl2832_sdr_alloc_stream_bufs(),

rtl2832_sdr_alloc_urbs() and rtl2832_sdr_submit_urbs() in sequence and

shares a single err: label that only unlocks the mutex and returns.

When alloc_urbs() succeeds but submit_urbs() fails, or when alloc_urbs()

itself returns -ENOMEM after alloc_stream_bufs() has already succeeded,

the URBs and/or the coherent DMA stream buffers stay allocated while

streaming reports failure to vb2. Two latent defects follow on the next

VIDIOC_STREAMON:

1) rtl2832_sdr_alloc_stream_bufs() unconditionally resets dev->buf_num

to 0 and overwrites dev->buf_list[]/dev->dma_addr[], permanently

leaking the coherent DMA memory allocated by the previous attempt.

2) rtl2832_sdr_alloc_urbs() never resets dev->urbs_initialized and only

increments it. After a second successful pass urbs_i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References