{"id":"CVE-2026-68216","title":"media: pwc: Return queued buffers on start_streaming() failure","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pwc: Return queued buffers on start_streaming() failure\n\nThe vb2 framework hands buffers to the driver via buf_queue() before\ncalling start_streaming().  If star…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3","Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < 0362ae30b61b3053ee3095c1b8f179197ec4f539","Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < fa78e590852751d3ad32f33f6b4e210fe6ccbe9b","Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < f2f9fcacd81953dde6cb86312ab13ca13e689664","Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < 5d7cc2634c3843a1414a0f6407aa17f1f91dee60","Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < cb16b79a2be2cec9c3ebe4147490817c4d8b1de3","Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < a4f8f629983f643333e49df90557805469bcbb25","Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < 975b2ee20e569d47821e4f6c9761b4664d48a6a4","Linux 3.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:45:58.459498Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:04.043Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68216","references":[{"url":"https://git.kernel.org/stable/c/d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3"},{"url":"https://git.kernel.org/stable/c/0362ae30b61b3053ee3095c1b8f179197ec4f539"},{"url":"https://git.kernel.org/stable/c/fa78e590852751d3ad32f33f6b4e210fe6ccbe9b"},{"url":"https://git.kernel.org/stable/c/f2f9fcacd81953dde6cb86312ab13ca13e689664"},{"url":"https://git.kernel.org/stable/c/5d7cc2634c3843a1414a0f6407aa17f1f91dee60"},{"url":"https://git.kernel.org/stable/c/cb16b79a2be2cec9c3ebe4147490817c4d8b1de3"},{"url":"https://git.kernel.org/stable/c/a4f8f629983f643333e49df90557805469bcbb25"},{"url":"https://git.kernel.org/stable/c/975b2ee20e569d47821e4f6c9761b4664d48a6a4"}],"tags":["cve.org"],"epss":0.00176,"epssPercentile":0.06681,"ingestedAt":"2026-10-16T17:24:46.852Z","slug":"CVE-2026-68216","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pwc: Return queued buffers on start_streaming() failure\n\nThe vb2 framework hands buffers to the driver via buf_queue() before\ncalling start_streaming().  If start_streaming() returns an error\nwithout first returning those buffers via vb2_buffer_done(),\nvb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued\nbuffers leak.\n\npwc's start_streaming() had two early returns that hit this trap:\n-ENODEV when the USB device was already disconnected, and -ERESTARTSYS\nwhen mutex_lock_interruptible() was interrupted by a signal.  Call the\nexisting pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED\nbefore returning (matching the state already used by the\npwc_isoc_init() error path in the same function).\n\nThis mirrors the uvcvideo fix in commit 4cf3b6fd54eb (\"media: uvcvideo:\nReturn queued buffers on start_streaming() failure\").\n\n## Affected\n\n- `Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3`\n- `Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < 0362ae30b61b3053ee3095c1b8f179197ec4f539`\n- `Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < fa78e590852751d3ad32f33f6b4e210fe6ccbe9b`\n- `Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < f2f9fcacd81953dde6cb86312ab13ca13e689664`\n- `Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < 5d7cc2634c3843a1414a0f6407aa17f1f91dee60`\n- `Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < cb16b79a2be2cec9c3ebe4147490817c4d8b1de3`\n- `Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < a4f8f629983f643333e49df90557805469bcbb25`\n- `Linux >= ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 < 975b2ee20e569d47821e4f6c9761b4664d48a6a4`\n- `Linux 3.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}