{"id":"CVE-2026-68214","summary":"media: rtl2832: fix use-after-free in rtl2832_remove()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rtl2832: fix use-after-free in rtl2832_remove()\n\ncancel_delayed_work_sync() is called before i2c_mux_del_adapters()\nin rtl2832_remove(). While the cancel waits for any running instance\nof i2c_gate_work to finish, it does not prevent the timer from being\nrescheduled by a concurrent thread.\n\nDuring probe, the r820t_attach() call attempts I2C transfers through\nthe mux adapter. These transfers go through i2c_mux_master_xfer(),\nwhich calls rtl2832_deselect() after the transfer completes,\nrescheduling i2c_gate_work via schedule_delayed_work(). If this\ntransfer is still in flight when rtl2832_remove() runs,\nrtl2832_deselect() can reschedule i2c_gate_work after it has been\ncancelled, causing a use-after-free when kfree(dev) is called.\n\nFix this by calling i2c_mux_del_adapters() before\ncancel_delayed_work_sync(). Once the mux adapter is unregistered, no\nnew I2C transfers can go through it, so rtl2832_deselect() can no\nlonger reschedule i2c_gate_work. The subsequent\ncancel_delayed_work_sync() is then guaranteed to be final.","modified":"2026-08-21T03:30:24.782939589Z","published":"2026-08-10T12:00:33.539Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68214.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/13c06056699e66ff7109ba68658cc6ea4a23f516"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1e8a6bc19403661661fed5ae82f6eca6c9cdfad2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/24bef237eef8dd1ebcffb129ba21891ddad0d309"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2c71bda6edc630a1f8c3c45d8df5fc22d234e042"},{"type":"WEB","url":"https://git.kernel.org/stable/c/680daf40a82d483949f87f0d8f98639dc47e610c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/68a9c0290897c1436ddceb8cea604c93377a0299"},{"type":"WEB","url":"https://git.kernel.org/stable/c/90d781711418881f8c836c2a859cc2886625d750"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9acd5bbbe1df8e487e49488692c224496d4c9e16"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68214.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68214"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"cddcc40b1b1553010acb89add84c64b5d123ec94"},{"fixed":"1e8a6bc19403661661fed5ae82f6eca6c9cdfad2"},{"fixed":"68a9c0290897c1436ddceb8cea604c93377a0299"},{"fixed":"13c06056699e66ff7109ba68658cc6ea4a23f516"},{"fixed":"9acd5bbbe1df8e487e49488692c224496d4c9e16"},{"fixed":"24bef237eef8dd1ebcffb129ba21891ddad0d309"},{"fixed":"2c71bda6edc630a1f8c3c45d8df5fc22d234e042"},{"fixed":"90d781711418881f8c836c2a859cc2886625d750"},{"fixed":"680daf40a82d483949f87f0d8f98639dc47e610c"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68214.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0"},{"fixed":"5.10.265"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.216"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.183"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.148"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.101"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.42"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.1.6"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68214.json"}}],"schema_version":"1.9.0"}