CVE-2026-68214

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the rtl2832 remove() function. The problem occurs because cancel delayed work sync() is called before i2c mux del adapters(), which fails to prevent a concurrent thread from rescheduling the i2c gate work timer. Specifically, during a probe, the r820t attach() function initiates I2C transfers via i2c mux master xfer(), which subsequently calls rtl2832 deselect() to reschedule i2c gate work using schedule delayed work(). If a transfer is active while rtl2832 remove() is executing, rtl2832 deselect() may reschedule the work after it was cancelled, leading to a use-after-free when kfree(dev) is called.

Recommendations Update the Linux kernel to a version where i2c mux del adapters() is called before cancel delayed work sync() within the rtl2832 remove() function.