---
id: CVE-2026-68211
title: 'media: stm32-dcmipp: Return queued buffers on start_streaming() failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  media: stm32-dcmipp: Return queued buffers on start_streaming() failure

  The vb2 framework hands buffers to the driver via buf_queue() before
  calling start_streaming().…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 28e0f37722965fa150af31d82101c95fd21aef60 <
    c1800238a60b0584b1924f11ce38ec8aba533238
  - >-
    Linux >= 28e0f37722965fa150af31d82101c95fd21aef60 <
    ed342a86bb2f9c1b44a0fc4f6b08c14073946e4f
  - >-
    Linux >= 28e0f37722965fa150af31d82101c95fd21aef60 <
    624af2d4b5e9d3dd366538e4fb4a2a037792a7e3
  - >-
    Linux >= 28e0f37722965fa150af31d82101c95fd21aef60 <
    ffc8eec06378a340d708c889184ab3e14b57d540
  - Linux 6.8
published: '2026-08-10'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:43:33.155Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68211'
references:
  - url: 'https://git.kernel.org/stable/c/c1800238a60b0584b1924f11ce38ec8aba533238'
  - url: 'https://git.kernel.org/stable/c/ed342a86bb2f9c1b44a0fc4f6b08c14073946e4f'
  - url: 'https://git.kernel.org/stable/c/624af2d4b5e9d3dd366538e4fb4a2a037792a7e3'
  - url: 'https://git.kernel.org/stable/c/ffc8eec06378a340d708c889184ab3e14b57d540'
tags:
  - cve.org
epss: 0.00173
epssPercentile: 0.06401
ingestedAt: '2026-10-21T12:48:53.603Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

media: stm32-dcmipp: Return queued buffers on start_streaming() failure

The vb2 framework hands buffers to the driver via buf_queue() before
calling start_streaming().  If start_streaming() returns an error
without first returning those buffers via vb2_buffer_done(),
vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued
buffers leak.

dcmipp_bytecap_start_streaming() returned -EINVAL when the source
subdevice could not be resolved from the media graph, before
pm_runtime_resume_and_get() and media_pipeline_start() had been called.
The remaining error paths already converge on the err_buffer_done
label, which calls dcmipp_bytecap_all_buffers_done(...,
VB2_BUF_STATE_QUEUED).  Jump to that label directly: the intermediate
err_pm_put / err_media_pipeline_stop labels are skipped, which is
correct because nothing they would undo has happened yet.

This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo:
Return queued buffers on start_streaming() failure").

## Affected

- `Linux >= 28e0f37722965fa150af31d82101c95fd21aef60 < c1800238a60b0584b1924f11ce38ec8aba533238`
- `Linux >= 28e0f37722965fa150af31d82101c95fd21aef60 < ed342a86bb2f9c1b44a0fc4f6b08c14073946e4f`
- `Linux >= 28e0f37722965fa150af31d82101c95fd21aef60 < 624af2d4b5e9d3dd366538e4fb4a2a037792a7e3`
- `Linux >= 28e0f37722965fa150af31d82101c95fd21aef60 < ffc8eec06378a340d708c889184ab3e14b57d540`
- `Linux 6.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.