CVE-2026-68216 (GCVE-0-2026-68216)
Vulnerability from cvelistv5
Published
2026-08-10 12:00
Modified
2026-08-19 16:31
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: pwc: Return queued buffers on start_streaming() failure
The vb2 framework hands buffers to the driver via buf_queue() before
calling start_streaming(). If start_streaming() returns an error
without first returning those buffers via vb2_buffer_done(),
vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued
buffers leak.
pwc's start_streaming() had two early returns that hit this trap:
-ENODEV when the USB device was already disconnected, and -ERESTARTSYS
when mutex_lock_interruptible() was interrupted by a signal. Call the
existing pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED
before returning (matching the state already used by the
pwc_isoc_init() error path in the same function).
This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo:
Return queued buffers on start_streaming() failure").
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 Version: ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 Version: ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 Version: ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 Version: ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 Version: ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 Version: ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 Version: ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/usb/pwc/pwc-if.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3",
"status": "affected",
"version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478",
"versionType": "git"
},
{
"lessThan": "0362ae30b61b3053ee3095c1b8f179197ec4f539",
"status": "affected",
"version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478",
"versionType": "git"
},
{
"lessThan": "fa78e590852751d3ad32f33f6b4e210fe6ccbe9b",
"status": "affected",
"version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478",
"versionType": "git"
},
{
"lessThan": "f2f9fcacd81953dde6cb86312ab13ca13e689664",
"status": "affected",
"version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478",
"versionType": "git"
},
{
"lessThan": "5d7cc2634c3843a1414a0f6407aa17f1f91dee60",
"status": "affected",
"version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478",
"versionType": "git"
},
{
"lessThan": "cb16b79a2be2cec9c3ebe4147490817c4d8b1de3",
"status": "affected",
"version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478",
"versionType": "git"
},
{
"lessThan": "a4f8f629983f643333e49df90557805469bcbb25",
"status": "affected",
"version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478",
"versionType": "git"
},
{
"lessThan": "975b2ee20e569d47821e4f6c9761b4664d48a6a4",
"status": "affected",
"version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/usb/pwc/pwc-if.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.148",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.101",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.265",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.216",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.148",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.101",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.42",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.6",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pwc: Return queued buffers on start_streaming() failure\n\nThe vb2 framework hands buffers to the driver via buf_queue() before\ncalling start_streaming(). If start_streaming() returns an error\nwithout first returning those buffers via vb2_buffer_done(),\nvb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued\nbuffers leak.\n\npwc\u0027s start_streaming() had two early returns that hit this trap:\n-ENODEV when the USB device was already disconnected, and -ERESTARTSYS\nwhen mutex_lock_interruptible() was interrupted by a signal. Call the\nexisting pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED\nbefore returning (matching the state already used by the\npwc_isoc_init() error path in the same function).\n\nThis mirrors the uvcvideo fix in commit 4cf3b6fd54eb (\"media: uvcvideo:\nReturn queued buffers on start_streaming() failure\")."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is reached through the VIDIOC_STREAMON ioctl on a local V4L2 device node (/dev/videoN) exposed by the pwc USB webcam driver, so the attacker needs local access to the system rather than network reachability.\nAC:L - The -ERESTARTSYS path is triggered deterministically by the attacker: hold pdev-\u003ev4l2_lock from a second thread/fd and send a signal to the thread blocked in mutex_lock_interruptible() inside start_streaming(), so both sides of the timing window are attacker-controlled and repeatable.\nPR:L - Only an unprivileged local account with access to the video device node (typical for desktop, kiosk and embedded video appliances, where the video group or logind ACLs grant it) is needed; no capabilities or root are required.\nUI:N - The attacker performs the entire sequence (REQBUFS, QBUF, STREAMON, signal delivery) from its own process; no action by any other user is needed.\nS:U - The buffer-accounting breakage and the resulting list corruption stay within the kernel\u0027s own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - Buffers left on pdev-\u003equeued_bufs after vb2 has already reclaimed them to QUEUED are re-linked on the next STREAMON, so the same pwc_frame_buf can be filled and completed while vb2 considers it userspace-owned, allowing an attacker to read kernel-managed frame data through stale mmap\u0027ed buffers.\nI:H - The double list_add_tail() of an already-linked buf-\u003elist node corrupts the driver\u0027s queued-buffer list and desynchronizes vb2\u0027s owned_by_drv_count, giving overlapping kernel/userspace ownership of buffer objects that can be leveraged for controlled modification of kernel-side state.\nA:H - Each attempt fires WARN_ON(owned_by_drv_count) in vb2_start_streaming(), which panics the machine on panic_on_warn kernels, and the leaked/corrupted buffer list additionally leads to lost buffers and unstable streaming state on subsequent STREAMON/STREAMOFF cycles."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T16:31:47.114Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3"
},
{
"url": "https://git.kernel.org/stable/c/0362ae30b61b3053ee3095c1b8f179197ec4f539"
},
{
"url": "https://git.kernel.org/stable/c/fa78e590852751d3ad32f33f6b4e210fe6ccbe9b"
},
{
"url": "https://git.kernel.org/stable/c/f2f9fcacd81953dde6cb86312ab13ca13e689664"
},
{
"url": "https://git.kernel.org/stable/c/5d7cc2634c3843a1414a0f6407aa17f1f91dee60"
},
{
"url": "https://git.kernel.org/stable/c/cb16b79a2be2cec9c3ebe4147490817c4d8b1de3"
},
{
"url": "https://git.kernel.org/stable/c/a4f8f629983f643333e49df90557805469bcbb25"
},
{
"url": "https://git.kernel.org/stable/c/975b2ee20e569d47821e4f6c9761b4664d48a6a4"
}
],
"title": "media: pwc: Return queued buffers on start_streaming() failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-68216",
"datePublished": "2026-08-10T12:00:35.592Z",
"dateReserved": "2026-07-30T09:28:09.375Z",
"dateUpdated": "2026-08-19T16:31:47.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…