CVE-2026-68216

media: pwc: Return queued buffers on start_streaming() failure

State: Published
Severity: 7.8 High
Published: Aug 10, 2026
Updated: Oct 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

media: pwc: Return queued buffers on start_streaming() failure

The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak.

pwc's start_streaming() had two early returns that hit this trap: -ENODEV when the USB device was already disconnected, and -ERESTARTSYS when mutex_lock_interruptible() was interrupted by a signal. Call the existing pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED before returning (matching the state already used by the pwc_isoc_init() error path in the same function).

This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3Affected ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before 0362ae30b61b3053ee3095c1b8f179197ec4f539Affected ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before fa78e590852751d3ad32f33f6b4e210fe6ccbe9bAffected ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before f2f9fcacd81953dde6cb86312ab13ca13e689664Affected ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before 5d7cc2634c3843a1414a0f6407aa17f1f91dee60Affected ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before cb16b79a2be2cec9c3ebe4147490817c4d8b1de3Affected ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before a4f8f629983f643333e49df90557805469bcbb25Affected ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before 975b2ee20e569d47821e4f6c9761b4664d48a6a4Affected
LinuxLinux	3.5Affected before 3.5Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3Affected
ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before 0362ae30b61b3053ee3095c1b8f179197ec4f539Affected
ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before fa78e590852751d3ad32f33f6b4e210fe6ccbe9bAffected
ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before f2f9fcacd81953dde6cb86312ab13ca13e689664Affected
ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before 5d7cc2634c3843a1414a0f6407aa17f1f91dee60Affected
ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before cb16b79a2be2cec9c3ebe4147490817c4d8b1de3Affected
ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before a4f8f629983f643333e49df90557805469bcbb25Affected
ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 to before 975b2ee20e569d47821e4f6c9761b4664d48a6a4Affected

LinuxLinux

3.5Affected
before 3.5Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.