Executive brief
The Linux kernel's infrared remote control driver for Allwinner SoCs (sunxi-cir) failed to properly clean up device registrations when the probe initialization encountered errors after successful device registration. This could leave stale device registrations in memory, potentially causing resource leaks, denial of service, or stability issues on systems using this driver.
Technical details
The vulnerability is a resource management bug (missing cleanup/unwind) in the sunxi-cir infrared receiver driver probe function (drivers/media/rc/sunxi-cir.c). After rc_register_device() succeeds, if subsequent initialization steps (IRQ lookup, IRQ request, or hardware initialization) fail, the error path jumps to an exit label that calls only rc_free_device(), omitting the required rc_unregister_device() call. This leaves the registered device and resources allocated by rc_register_device() in memory. The fix adds a separate error unwind label (exit_unregister_dev) that calls rc_unregister_device() before rc_free_device() for failures after registration. The issue affects the driver's probe phase (kernel initialization/module load) and requires local access to trigger via device probe failures.
Affected products
- Linux Linux kernel multiple versions (see git stable branches)
Timeline
- 2026-09-16: disclosed: CVE published
- 2026-06-29: patched: Upstream fix merged (commit 479aa6fa8c50f1052f1451326ef7d4d586d340c3)
- 2026-09-14: patched: Backported to stable tree (commit 4655a591478e4b31a3396695a2457daad9d4c899)