{"id":"CVE-2026-68214","state":"PUBLISHED","title":"media: rtl2832: fix use-after-free in rtl2832_remove()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rtl2832: fix use-after-free in rtl2832_remove()\n\ncancel_delayed_work_sync() is called before i2c_mux_del_adapters()\nin rtl2832_remove(). While the cancel waits for any running instance\nof i2c_gate_work to finish, it does not prevent the timer from being\nrescheduled by a concurrent thread.\n\nDuring probe, the r820t_attach() call attempts I2C transfers through\nthe mux adapter. These transfers go through i2c_mux_master_xfer(),\nwhich calls rtl2832_deselect() after the transfer completes,\nrescheduling i2c_gate_work via schedule_delayed_work(). If this\ntransfer is still in flight when rtl2832_remove() runs,\nrtl2832_deselect() can reschedule i2c_gate_work after it has been\ncancelled, causing a use-after-free when kfree(dev) is called.\n\nFix this by calling i2c_mux_del_adapters() before\ncancel_delayed_work_sync(). Once the mux adapter is unregistered, no\nnew I2C transfers can go through it, so rtl2832_deselect() can no\nlonger reschedule i2c_gate_work. The subsequent\ncancel_delayed_work_sync() is then guaranteed to be final.","publishedAt":"2026-08-10T12:00:33.539Z","updatedAt":"2026-08-19T16:31:42.193Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"1e8a6bc19403661661fed5ae82f6eca6c9cdfad2","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"68a9c0290897c1436ddceb8cea604c93377a0299","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"13c06056699e66ff7109ba68658cc6ea4a23f516","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"9acd5bbbe1df8e487e49488692c224496d4c9e16","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"24bef237eef8dd1ebcffb129ba21891ddad0d309","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"2c71bda6edc630a1f8c3c45d8df5fc22d234e042","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"90d781711418881f8c836c2a859cc2886625d750","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"680daf40a82d483949f87f0d8f98639dc47e610c","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/dvb-frontends/rtl2832.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.7","versionType":"semver"},{"version":"5.10.265","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/dvb-frontends/rtl2832.c"]}],"references":["https://git.kernel.org/stable/c/1e8a6bc19403661661fed5ae82f6eca6c9cdfad2","https://git.kernel.org/stable/c/68a9c0290897c1436ddceb8cea604c93377a0299","https://git.kernel.org/stable/c/13c06056699e66ff7109ba68658cc6ea4a23f516","https://git.kernel.org/stable/c/9acd5bbbe1df8e487e49488692c224496d4c9e16","https://git.kernel.org/stable/c/24bef237eef8dd1ebcffb129ba21891ddad0d309","https://git.kernel.org/stable/c/2c71bda6edc630a1f8c3c45d8df5fc22d234e042","https://git.kernel.org/stable/c/90d781711418881f8c836c2a859cc2886625d750","https://git.kernel.org/stable/c/680daf40a82d483949f87f0d8f98639dc47e610c"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68214.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68214","state":"PUBLISHED","datePublished":"2026-08-10T12:00:33.539Z","dateUpdated":"2026-08-19T16:31:42.193Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.375Z"},"containers":{"cna":{"title":"media: rtl2832: fix use-after-free in rtl2832_remove()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rtl2832: fix use-after-free in rtl2832_remove()\n\ncancel_delayed_work_sync() is called before i2c_mux_del_adapters()\nin rtl2832_remove(). While the cancel waits for any running instance\nof i2c_gate_work to finish, it does not prevent the timer from being\nrescheduled by a concurrent thread.\n\nDuring probe, the r820t_attach() call attempts I2C transfers through\nthe mux adapter. These transfers go through i2c_mux_master_xfer(),\nwhich calls rtl2832_deselect() after the transfer completes,\nrescheduling i2c_gate_work via schedule_delayed_work(). If this\ntransfer is still in flight when rtl2832_remove() runs,\nrtl2832_deselect() can reschedule i2c_gate_work after it has been\ncancelled, causing a use-after-free when kfree(dev) is called.\n\nFix this by calling i2c_mux_del_adapters() before\ncancel_delayed_work_sync(). Once the mux adapter is unregistered, no\nnew I2C transfers can go through it, so rtl2832_deselect() can no\nlonger reschedule i2c_gate_work. The subsequent\ncancel_delayed_work_sync() is then guaranteed to be final."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"1e8a6bc19403661661fed5ae82f6eca6c9cdfad2","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"68a9c0290897c1436ddceb8cea604c93377a0299","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"13c06056699e66ff7109ba68658cc6ea4a23f516","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"9acd5bbbe1df8e487e49488692c224496d4c9e16","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"24bef237eef8dd1ebcffb129ba21891ddad0d309","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"2c71bda6edc630a1f8c3c45d8df5fc22d234e042","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"90d781711418881f8c836c2a859cc2886625d750","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","status":"affected","lessThan":"680daf40a82d483949f87f0d8f98639dc47e610c","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/dvb-frontends/rtl2832.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.7","versionType":"semver"},{"version":"5.10.265","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/dvb-frontends/rtl2832.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/1e8a6bc19403661661fed5ae82f6eca6c9cdfad2"},{"url":"https://git.kernel.org/stable/c/68a9c0290897c1436ddceb8cea604c93377a0299"},{"url":"https://git.kernel.org/stable/c/13c06056699e66ff7109ba68658cc6ea4a23f516"},{"url":"https://git.kernel.org/stable/c/9acd5bbbe1df8e487e49488692c224496d4c9e16"},{"url":"https://git.kernel.org/stable/c/24bef237eef8dd1ebcffb129ba21891ddad0d309"},{"url":"https://git.kernel.org/stable/c/2c71bda6edc630a1f8c3c45d8df5fc22d234e042"},{"url":"https://git.kernel.org/stable/c/90d781711418881f8c836c2a859cc2886625d750"},{"url":"https://git.kernel.org/stable/c/680daf40a82d483949f87f0d8f98639dc47e610c"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-19T16:31:42.193Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.10.265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}