{"id":"CVE-2026-89900","revision":"467de1f03bfe47bab811dbb9bdfde9b0","records":[{"revision":"467de1f03bfe47bab811dbb9bdfde9b0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-89900","aliases":[],"title":"media: cec: core: Fix kmemleak due to missed rc_free_device() call","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cec: core: Fix kmemleak due to missed rc_free_device() call\n\nThe commit dccc0c3ddf8f (\"media: rc: fix race between unregister and\nurb/irq callbacks\") removed the implicit call to rc_free_device() from\nrc_unregister_device(). However, the commit missed to remove the NULL\nassignment of adap->rc that is now causing rc_free_device() to never be\ncalled on an allocated rc device.\n\nkmemleak reports following after e.g. dw-hdmi unbind:\n\nunreferenced object 0xffff00010ac10000 (size 4096):\n  comm \"kworker/u16:1\", pid 39, jiffies 4294897739\n  hex dump (first 32 bytes):\n    20 23 4b 0a 01 00 ff ff 08 00 c1 0a 01 00 ff ff   #K.............\n    08 00 c1 0a 01 00 ff ff 00 00 00 00 00 00 00 00  ................\n  backtrace (crc e11baccc):\n    kmemleak_alloc+0x38/0x44\n    __kmalloc_cache_noprof+0x4a8/0x5e0\n    rc_allocate_device+0x48/0x2a0\n    cec_allocate_adapter+0x3ac/0x800\n    dw_hdmi_cec_probe+0x264/0x634\n    platform_probe+0xc0/0x188\n    really_probe+0x4a4/0x8e0\n    __driver_probe_device+0x2f8/0x440\n    driver_probe_device+0x60/0x160\n    __device_attach_driver+0x1a0/0x2a0\n    bus_for_each_drv+0x100/0x1a0\n    __device_attach+0x174/0x350\n    device_initial_probe+0x90/0xb0\n    bus_probe_device+0x4c/0x120\n    device_add+0xdec/0x116c\n    platform_device_add+0x354/0x598\n\nRemove the assignment of adap->rc to NULL to let cec_delete_adapter()\nfree the allocated rc device after last user of the cec device exits to\nfix the kmemleak.","state":0,"publishedAt":"2026-09-16T10:32:00.289+00:00","modifiedAt":"2026-10-19T08:54:33.144+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/media/cec/core/cec-core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a7becb58f6b8a3a3efe5d3acfd52e2c107de6772\",\n                            \"lessThan\": \"954ee95a03b4d31d4505591bfaba02c24b75776b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"75977f5f5c4974c72bbedefbf09ad33ebbaa36f1\",\n                            \"lessThan\": \"f28a8e1ba4d67a18e4662e5acefd5a4389322366\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e250b672d40a9e0d97a8895cbb301248bea0fce6\",\n                            \"lessThan\": \"695063fc57574dd117b1bc750ca189cf03a2caad\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dccc0c3ddf8f16071736f98a7d6dd46a2d43e037\",\n                            \"lessThan\": \"cca2407794795cecff7f8e5f5a79f4ef6b1d6f6c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dccc0c3ddf8f16071736f98a7d6dd46a2d43e037\",\n                            \"lessThan\": \"a24ba0653f7154e671dc8d2bf64682ab2d042792\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.6.143\",\n                            \"lessThan\": \"6.6.157\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.93\",\n                            \"lessThan\": \"6.12.110\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.35\",\n                            \"lessThan\": \"6.18.51\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/media/cec/core/cec-core.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.51\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.5\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/954ee95a03b4d31d4505591bfaba02c24b75776b","https://git.kernel.org/stable/c/f28a8e1ba4d67a18e4662e5acefd5a4389322366","https://git.kernel.org/stable/c/695063fc57574dd117b1bc750ca189cf03a2caad","https://git.kernel.org/stable/c/cca2407794795cecff7f8e5f5a79f4ef6b1d6f6c","https://git.kernel.org/stable/c/a24ba0653f7154e671dc8d2bf64682ab2d042792"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89900","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-89900","identifiers":["CVE-2026-89900"]},"retained":false,"historicalAffected":[]}],"coverage":[]}