CVE-2026-68214

Received Received - Intake

Use-After-Free in RTL2832 Linux Kernel Driver

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832: fix use-after-free in rtl2832_remove() cancel_delayed_work_sync() is called before i2c_mux_del_adapters() in rtl2832_remove(). While the cancel waits for any running instance of i2c_gate_work to finish, it does not prevent the timer from being rescheduled by a concurrent thread. During probe, the r820t_attach() call attempts I2C transfers through the mux adapter. These transfers go through i2c_mux_master_xfer(), which calls rtl2832_deselect() after the transfer completes, rescheduling i2c_gate_work via schedule_delayed_work(). If this transfer is still in flight when rtl2832_remove() runs, rtl2832_deselect() can reschedule i2c_gate_work after it has been cancelled, causing a use-after-free when kfree(dev) is called. Fix this by calling i2c_mux_del_adapters() before cancel_delayed_work_sync(). Once the mux adapter is unregistered, no new I2C transfers can go through it, so rtl2832_deselect() can no longer reschedule i2c_gate_work. The subsequent cancel_delayed_work_sync() is then guaranteed to be final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68214

EUVD

EUVD-2026-55315

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	rtl2832	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's RTL2832 media driver. It occurs when the driver's remove function cancels a delayed work item but another thread can still reschedule it. This leads to a use-after-free when the device structure is freed while the work item is still active.

Detection Guidance

This vulnerability is specific to the Linux kernel's RTL2832 driver and requires kernel-level inspection. Detection involves checking the kernel version and loaded modules for the affected driver. Use commands like 'uname -a' to check kernel version and 'lsmod | grep rtl2832' to see if the vulnerable module is loaded.

Impact Analysis

This vulnerability could cause system crashes or memory corruption if exploited. It may lead to denial-of-service conditions or privilege escalation if an attacker triggers the use-after-free scenario.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's media driver for RTL2832 devices. It does not directly relate to data privacy or security controls required by standards like GDPR or HIPAA. The impact is limited to kernel memory corruption during device removal, which could cause system instability but does not inherently violate compliance requirements.

Mitigation Strategies

Update the Linux kernel to a patched version where the RTL2832 driver fix is included. If immediate update is not possible, consider unloading the rtl2832 module with 'modprobe -r rtl2832' to prevent exploitation until a permanent fix is applied.

Hi! I’m here to help you understand CVE-2026-68214. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70