Executive brief
A memory leak exists in the Linux kernel's media CEC (Consumer Electronics Control) subsystem that affects HDMI-connected devices. When certain devices like HDMI receivers unbind or disconnect, allocated memory is not properly freed, potentially causing resource exhaustion on systems that repeatedly attach and detach such devices.
Technical details
The vulnerability is a resource leak (kmemleak) in the CEC adapter code caused by a missed cleanup in commit dccc0c3ddf8f. That commit removed the implicit rc_free_device() call from rc_unregister_device(), but left a NULL assignment to adap->rc that prevents rc_free_device() from being invoked on the allocated remote control device structure. The root cause is in cec_allocate_adapter() and its cleanup path in cec_delete_adapter(). No user authentication or network access is required—the leak occurs during normal unbind/removal of HDMI-CEC devices. An attacker with local access to repeatedly bind/unbind devices could exhaust kernel memory. The fix is to remove the erroneous NULL assignment so that the cleanup path properly frees the rc device.
Affected products
- Linux Linux kernel versions after commit dccc0c3ddf8f
Timeline
- 2026-09-16: disclosed
- 2026-09-16: advisory: CVE-2026-89900 published