Executive brief
The rtl2832_sdr USB driver used for software-defined radio applications has a resource leak affecting system memory. When a USB device is disconnected while streaming, allocated DMA buffers are not properly freed, gradually consuming memory and potentially impacting system stability over time.
Technical details
This is a resource management vulnerability in the rtl2832_sdr media driver. The root cause is a race condition: rtl2832_sdr_remove() clears the dev->udev pointer on USB disconnect before pending streaming operations complete. When user space later closes its file descriptor, vb2 triggers rtl2832_sdr_stop_streaming() which attempts to free DMA buffers via usb_free_coherent(). Since dev->udev is already NULL, usb_free_coherent() silently returns without freeing the buffers, and the same applies to allocated URBs. The vulnerability requires the device to be actively streaming at disconnect time. The fix uses vb2_video_unregister_device() instead of video_unregister_device(), ensuring the vb2 queue is released synchronously while dev->udev is still valid, allowing proper cleanup of URBs and DMA buffers.
Affected products
- Linux Linux kernel <parameter>
Timeline
- 2026-09-16: disclosed