HIGH Introduced in 3.17
sunxi-cir RcDevice Leak
CVE-2026-89883
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI4.8MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: media: rc: sunxi-cir: Unregister rc device on probe failure After rc_register_device() succeeds, later probe failures must undo the registration with rc_unregister_device(). The current error path jumps to the allocation cleanup label and only calls rc_free_device(), leaving the rc device registration and resources created by rc_register_device() behind. Add a registered-device unwind label for the IRQ lookup, IRQ request, and hardware initialization failure paths. Keep rc_free_device() for failures before rc_register_device() succeeds.
02KernelScan AI Analysis
Risk summary
A bug in the Allwinner (sunxi) infrared remote controller driver leaves an RC device registered when a late probe step fails, leaking kernel resources and potentially causing a kernel oops when the dangling device is later accessed. The issue is reachable only on systems with the sunxi CIR hardware and requires the driver to be loaded and probe to partially fail, which is typically under administrator control.
Vulnerability analysis
When the sunxi infrared remote controller driver sets up a device, it registers the remote-control device before finishing the rest of initialization. If a later setup step fails, the cleanup path frees the driver structure without first removing the active registration, leaving kernel resources and device entries behind. This stale state can trigger a crash or leak resources if the dangling registration is accessed later. The fix ensures the registration is properly removed before cleanup whenever a failure happens after the device has been registered. The issue only affects systems built with the Allwinner sunxi CIR hardware, and the failing setup path is normally reached only under privileged or boot-time control.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 3.17 | 5.15.221 | 4655a591478e |
| 6.1 | 3.17 | 6.1.188 | 4efd7146dcf9 |
| 6.12 | 3.17 | 6.12.110 | 59951b8a87ef |
| 6.18 | 3.17 | 6.18.51 | 5b58d8c206f3 |
| 6.6 | 3.17 | 6.6.157 | 826763adbd8b |
| 7.2 | 3.17 | 7.2.5 | 5e6f5bffaa80 |
| mainline | 3.17 | 7.3 | 479aa6fa8c50 |
| cip/6.1 | 3.17 | 6.1.189-cip61 | 4efd7146dcf9 |
| cip/6.1-rt | 3.17 | 6.1.189-cip61-rt32 | 4efd7146dcf9 |
| cip/6.12 | 3.17 | 6.12.111-cip32 | 59951b8a87ef |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |