AUGUST 16, 2026
Live Feed
Back to database
Case File

CVE-2026-68216

HIGH · CVSS 7.8 EPSS 0.18%

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's pwc driver, where a failure in the start_streaming() function can lead to a leak of queued buffers if not properly handled. This issue arises when the function returns an error without releasing the buffers, potentially impacting system stability and resource management. Organizations using Linux systems with the pwc driver should prioritize addressing this vulnerability to prevent potential resource leaks and ensure optimal performance.

CVE
CVE-2026-68216
Severity
HIGH
CVSS
7.8
EPSS
0.18%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: media: pwc: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. pwc's start_streaming() had two early returns that hit this trap: -ENODEV when the USB device was already disconnected, and -ERESTARTSYS when mutex_lock_interruptible() was interrupted by a signal. Call the existing pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED before returning (matching the state already used by the pwc_isoc_init() error path in the same function). This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").