Forwarded: KASAN: slab-use-after-free Read in dvb_frontend_release (3)

From: syzbot

Date: Thu Feb 19 2026 - 13:44:11 EST


For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx.

***

Subject: KASAN: slab-use-after-free Read in dvb_frontend_release (3)
Author: ttt978615@xxxxxxxxx

#syz test upstream c22e26bd0906e9c8325462993f01adb16b8ea2c0

--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -2911,6 +2911,7 @@ static int dvb_frontend_release(struct inode *inode,
struct file *file)
mb();
}

+ dvb_device_get(dvbdev);
ret = dvb_generic_release(inode, file);

if (dvbdev->users == -1) {
@@ -2931,6 +2932,7 @@ static int dvb_frontend_release(struct inode *inode,
struct file *file)
fe->ops.ts_bus_ctrl(fe, 0);
}

+ dvb_device_put(dvbdev);
dvb_frontend_put(fe);

return ret;