{"id":24587,"date":"2026-09-16T20:32:30","date_gmt":"2026-09-16T12:32:30","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89900"},"modified":"2026-09-16T20:32:30","modified_gmt":"2026-09-16T12:32:30","slug":"cve-2026-89900","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89900","title":{"rendered":"CVE-2026-89900 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: cec: core: Fix"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>media: cec: core: Fix kmemleak due to missed rc_free_device() call<\/p>\n<p>The commit dccc0c3ddf8f (&#8220;media: rc: fix race between unregister and<br \/>\nurb\/irq callbacks&#8221;) removed the implicit call to rc_free_device() from<br \/>\nrc_unregister_device(). However, the commit missed to remove the NULL<br \/>\nassignment of adap-&gt;rc that is now causing rc_free_device() to never be<br \/>\ncalled on an allocated rc device.<\/p>\n<p>kmemleak reports following after e.g. dw-hdmi unbind:<\/p>\n<p>unreferenced object 0xffff00010ac10000 (size 4096):<br \/>\n  comm &#8220;kworker\/u16:1&#8221;, pid 39, jiffies 4294897739<br \/>\n  hex dump (first 32 bytes):<br \/>\n    20 23 4b 0a 01 00 ff ff 08 00 c1 0a 01 00 ff ff   #K&#8230;&#8230;&#8230;&#8230;.<br \/>\n    08 00 c1 0a 01 00 ff ff 00 00 00 00 00 00 00 00  &#8230;&#8230;&#8230;&#8230;&#8230;.<br \/>\n  backtrace (crc e11baccc):<br \/>\n    kmemleak_alloc+0x38\/0x44<br \/>\n    __kmalloc_cache_noprof+0x4a8\/0x5e0<br \/>\n    rc_allocate_device+0x48\/0x2a0<br \/>\n    cec_allocate_adapter+0x3ac\/0x800<br \/>\n    dw_hdmi_cec_probe+0x264\/0x634<br \/>\n    platform_probe+0xc0\/0x188<br \/>\n    really_probe+0x4a4\/0x8e0<br \/>\n    __driver_probe_device+0x2f8\/0x440<br \/>\n    driver_probe_device+0x60\/0x160<br \/>\n    __device_attach_driver+0x1a0\/0x2a0<br \/>\n    bus_for_each_drv+0x100\/0x1a0<br \/>\n    __device_attach+0x174\/0x350<br \/>\n    device_initial_probe+0x90\/0xb0<br \/>\n    bus_probe_device+0x4c\/0x120<br \/>\n    device_add+0xdec\/0x116c<br \/>\n    platform_device_add+0x354\/0x598<\/p>\n<p>Remove the assignment of adap-&gt;rc to NULL to let cec_delete_adapter()<br \/>\nfree the allocated rc device after last user of the cec device exits to<br \/>\nfix the kmemleak.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>media: cec: core: Fix kmemleak due to missed rc_free_device() call<\/p>\n<p>The commit dccc0c3ddf8f (&#8220;media: rc: fix race between unregiste<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24587","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24587","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24587"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24587"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24587"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}