CVE-2026-68209

media: sun4i-csi: Return queued buffers on start_streaming() failure

State: Published
Severity: 7.8 High
Published: Aug 10, 2026
Updated: Aug 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

media: sun4i-csi: Return queued buffers on start_streaming() failure

The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak.

sun4i_csi_start_streaming() returned -EINVAL when no matching CSI format could be found, before any setup (scratch buffer allocation, pipeline start) had been performed. The remaining error paths already converge on the err_clear_dma_queue label, which calls return_all_buffers(..., VB2_BUF_STATE_QUEUED) under csi->qlock. Jump to that label directly: the intermediate err_disable_device / err_disable_pipeline / err_free_scratch_buffer labels are skipped, which is correct because nothing they would undo has happened yet.

This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	577bbf23b758848f0c4a50d346460b690c753024 to before 29fce7bcb3b959f6d4fdcdff7d26330152fdf98dAffected 577bbf23b758848f0c4a50d346460b690c753024 to before 7c2c30e282745a83d332c3cf92d1c0bcc491ac54Affected 577bbf23b758848f0c4a50d346460b690c753024 to before 3c0bd793b0083fd4639ba7f60d1e7db8c8ac459aAffected 577bbf23b758848f0c4a50d346460b690c753024 to before 4872161e6fbe4e1783daea8bff79caddfae0fb82Affected 577bbf23b758848f0c4a50d346460b690c753024 to before a8abecc638a7feb20b78fabd563b05e30c071331Affected 577bbf23b758848f0c4a50d346460b690c753024 to before b5184b3f0e9d4cc47059ba1138c9a73d43d2493fAffected 577bbf23b758848f0c4a50d346460b690c753024 to before 668face37fdb6b6900645dc8777195498541c9a7Affected 577bbf23b758848f0c4a50d346460b690c753024 to before bbba3e260a62810a717b4442a3bb96d0ec0f6309Affected
LinuxLinux	5.4Affected before 5.4Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

577bbf23b758848f0c4a50d346460b690c753024 to before 29fce7bcb3b959f6d4fdcdff7d26330152fdf98dAffected
577bbf23b758848f0c4a50d346460b690c753024 to before 7c2c30e282745a83d332c3cf92d1c0bcc491ac54Affected
577bbf23b758848f0c4a50d346460b690c753024 to before 3c0bd793b0083fd4639ba7f60d1e7db8c8ac459aAffected
577bbf23b758848f0c4a50d346460b690c753024 to before 4872161e6fbe4e1783daea8bff79caddfae0fb82Affected
577bbf23b758848f0c4a50d346460b690c753024 to before a8abecc638a7feb20b78fabd563b05e30c071331Affected
577bbf23b758848f0c4a50d346460b690c753024 to before b5184b3f0e9d4cc47059ba1138c9a73d43d2493fAffected
577bbf23b758848f0c4a50d346460b690c753024 to before 668face37fdb6b6900645dc8777195498541c9a7Affected
577bbf23b758848f0c4a50d346460b690c753024 to before bbba3e260a62810a717b4442a3bb96d0ec0f6309Affected

LinuxLinux

5.4Affected
before 5.4Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.