Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-68216

media: pwc: Return queued buffers on start_streaming() failure

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.265, 5.15.216, 6.1.183, 6.6.148, 6.12.101, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: media: pwc: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. pwc's start_streaming() had two early returns that hit this trap: -ENODEV when the USB device was already disconnected, and -ERESTARTSYS when mutex_lock_interruptible() was interrupted by a signal. Call the existing pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED before returning (matching the state already used by the pwc_isoc_init() error path in the same function). This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 · fixed in d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3; From ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 · fixed in 0362ae30b61b3053ee3095c1b8f179197ec4f539; From ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 · fixed in fa78e590852751d3ad32f33f6b4e210fe6ccbe9b; From ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 · fixed in f2f9fcacd81953dde6cb86312ab13ca13e689664; From ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 · fixed in 5d7cc2634c3843a1414a0f6407aa17f1f91dee60; From ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 · fixed in cb16b79a2be2cec9c3ebe4147490817c4d8b1de3; From ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 · fixed in a4f8f629983f643333e49df90557805469bcbb25; From ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 · fixed in 975b2ee20e569d47821e4f6c9761b4664d48a6a4

  • Linux Linux

    3.5

  • KernelLinux

    From 3.5.0 · fixed in 5.10.265; From 5.11.0 · fixed in 5.15.216; From 5.16.0 · fixed in 6.1.183; From 6.2.0 · fixed in 6.6.148; From 6.7.0 · fixed in 6.12.101; From 6.13.0 · fixed in 6.18.42; From 6.19.0 · fixed in 7.1.6

References 8

git.kernel.org