CVE-2026-68216media: pwc: Return queued buffers on start_streaming() failure
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: media: pwc: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. pwc's start_streaming() had two early returns that hit this trap: -ENODEV when the USB device was already disconnected, and -ERESTARTSYS when mutex_lock_interruptible() was interrupted by a signal. Call the existing pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED before returning (matching the state already used by the pwc_isoc_init() error path in the same function). This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3; from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before 0362ae30b61b3053ee3095c1b8f179197ec4f539; from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before fa78e590852751d3ad32f33f6b4e210fe6ccbe9b; from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before f2f9fcacd81953dde6cb86312ab13ca13e689664; from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before 5d7cc2634c3843a1414a0f6407aa17f1f91dee60; from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before cb16b79a2be2cec9c3ebe4147490817c4d8b1de3; from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before a4f8f629983f643333e49df90557805469bcbb25; from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before 975b2ee20e569d47821e4f6c9761b4664d48a6a4 | CNA record |
References
- https://git.kernel.org/stable/c/d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3
- https://git.kernel.org/stable/c/0362ae30b61b3053ee3095c1b8f179197ec4f539
- https://git.kernel.org/stable/c/fa78e590852751d3ad32f33f6b4e210fe6ccbe9b
- https://git.kernel.org/stable/c/f2f9fcacd81953dde6cb86312ab13ca13e689664
- https://git.kernel.org/stable/c/5d7cc2634c3843a1414a0f6407aa17f1f91dee60
- https://git.kernel.org/stable/c/cb16b79a2be2cec9c3ebe4147490817c4d8b1de3
- https://git.kernel.org/stable/c/a4f8f629983f643333e49df90557805469bcbb25
- https://git.kernel.org/stable/c/975b2ee20e569d47821e4f6c9761b4664d48a6a4
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.