EUVD-2026-80483
GHSA-53fc-6cww-57mr
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local only; AC:H because it needs an induced post-register probe failure not attacker-controlled; PR:L for local access; no confidentiality, minor integrity from dangling state, availability/DoS-dominant.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
media: rc: sunxi-cir: Unregister rc device on probe failure
After rc_register_device() succeeds, later probe failures must undo the registration with rc_unregister_device(). The current error path jumps to the allocation cleanup label and only calls rc_free_device(), leaving the rc device registration and resources created by rc_register_device() behind.
Add a registered-device unwind label for the IRQ lookup, IRQ request, and hardware initialization failure paths. Keep rc_free_device() for failures before rc_register_device() succeeds.
AnalysisAI
The Linux kernel's sunxi-cir driver (Allwinner CIR/IR receiver, media/rc subsystem) fails to unregister the rc device when probe fails after rc_register_device() has already succeeded, leaving the registration and its resources behind. This is a local, low-severity driver lifecycle bug: the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, since the fault requires a genuine probe failure at IRQ lookup, IRQ request, or hardware initialization - conditions that are not attacker-controllable in a default configuration and generally need local privileged access (forced bind/unbind, resource exhaustion, or device-tree/IRQ faults) to induce. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the sunxi-cir (Allwinner CIR/IR receiver) driver to be present and undergoing device probe, AND a probe failure occurring AFTER rc_register_device() succeeds - specifically at the IRQ lookup, IRQ request, or hardware-initialization step. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a classic vendor-inflated Linux kernel probe-error-path bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released fixes by upgrading to a patched stable kernel: 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, or 7.2.5 (mainline 7.3-rc1), or backport the relevant upstream commit such as https://git.kernel.org/stable/c/4655a591478e4b31a3396695a2457daad9d4c899 or https://git.kernel.org/stable/c/4efd7146dcf959afe64e9c51531cd8f82e60eab6 for older vendor trees; embedded/Android vendors that pin kernels must backport the unwind-label change rather than wait for a rebase. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems running on Allwinner hardware that have the sunxi-cir driver enabled or built-in, and prioritize them for patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today