Executive brief
The Linux kernel's rtl2832_sdr driver for DVB-T USB devices fails to properly clean up allocated memory when starting a video stream fails. This can lead to cumulative memory leaks and corruption of internal data structures on repeated failed stream attempts, potentially causing device malfunction or kernel crashes.
Technical details
The vulnerability is a resource cleanup failure in rtl2832_sdr_start_streaming() where allocated URBs and DMA stream buffers are not freed if submit_urbs() fails after alloc_urbs() succeeds. The function uses a single error label that only unlocks a mutex without performing teardown. On subsequent VIDIOC_STREAMON attempts, alloc_stream_bufs() unconditionally resets buf_num to 0, leaking previously allocated coherent DMA memory, and alloc_urbs() only increments urbs_initialized without resetting it, potentially causing out-of-bounds reads when urbs_initialized exceeds MAX_BULK_BUFS. The fix mirrors the stop_streaming() teardown by calling rtl2832_sdr_free_urbs() and rtl2832_sdr_free_stream_bufs() on the error path before unlocking, with both helpers designed to be idempotent.
Affected products
- Linux Linux kernel affected versions not explicitly specified in advisory
Timeline
- 2026-09-16: disclosed: CVE-2026-89880 published