{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68214","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.375Z","datePublished":"2026-08-10T12:00:33.539Z","dateUpdated":"2026-08-19T16:31:42.193Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-19T16:31:42.193Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: rtl2832: fix use-after-free in rtl2832_remove()\n\ncancel_delayed_work_sync() is called before i2c_mux_del_adapters()\nin rtl2832_remove(). While the cancel waits for any running instance\nof i2c_gate_work to finish, it does not prevent the timer from being\nrescheduled by a concurrent thread.\n\nDuring probe, the r820t_attach() call attempts I2C transfers through\nthe mux adapter. These transfers go through i2c_mux_master_xfer(),\nwhich calls rtl2832_deselect() after the transfer completes,\nrescheduling i2c_gate_work via schedule_delayed_work(). If this\ntransfer is still in flight when rtl2832_remove() runs,\nrtl2832_deselect() can reschedule i2c_gate_work after it has been\ncancelled, causing a use-after-free when kfree(dev) is called.\n\nFix this by calling i2c_mux_del_adapters() before\ncancel_delayed_work_sync(). Once the mux adapter is unregistered, no\nnew I2C transfers can go through it, so rtl2832_deselect() can no\nlonger reschedule i2c_gate_work. The subsequent\ncancel_delayed_work_sync() is then guaranteed to be final."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/dvb-frontends/rtl2832.c"],"versions":[{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","lessThan":"1e8a6bc19403661661fed5ae82f6eca6c9cdfad2","status":"affected","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","lessThan":"68a9c0290897c1436ddceb8cea604c93377a0299","status":"affected","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","lessThan":"13c06056699e66ff7109ba68658cc6ea4a23f516","status":"affected","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","lessThan":"9acd5bbbe1df8e487e49488692c224496d4c9e16","status":"affected","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","lessThan":"24bef237eef8dd1ebcffb129ba21891ddad0d309","status":"affected","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","lessThan":"2c71bda6edc630a1f8c3c45d8df5fc22d234e042","status":"affected","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","lessThan":"90d781711418881f8c836c2a859cc2886625d750","status":"affected","versionType":"git"},{"version":"cddcc40b1b1553010acb89add84c64b5d123ec94","lessThan":"680daf40a82d483949f87f0d8f98639dc47e610c","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/media/dvb-frontends/rtl2832.c"],"versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","status":"unaffected","versionType":"semver"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.148","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.10.265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1e8a6bc19403661661fed5ae82f6eca6c9cdfad2"},{"url":"https://git.kernel.org/stable/c/68a9c0290897c1436ddceb8cea604c93377a0299"},{"url":"https://git.kernel.org/stable/c/13c06056699e66ff7109ba68658cc6ea4a23f516"},{"url":"https://git.kernel.org/stable/c/9acd5bbbe1df8e487e49488692c224496d4c9e16"},{"url":"https://git.kernel.org/stable/c/24bef237eef8dd1ebcffb129ba21891ddad0d309"},{"url":"https://git.kernel.org/stable/c/2c71bda6edc630a1f8c3c45d8df5fc22d234e042"},{"url":"https://git.kernel.org/stable/c/90d781711418881f8c836c2a859cc2886625d750"},{"url":"https://git.kernel.org/stable/c/680daf40a82d483949f87f0d8f98639dc47e610c"}],"title":"media: rtl2832: fix use-after-free in rtl2832_remove()","x_generator":{"engine":"bippy-1.2.0"}}}}