{"id":"CVE-2026-68216","revision":"4ddd8fea600345869c726f647b65413f","records":[{"revision":"4ddd8fea600345869c726f647b65413f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68216","aliases":[],"title":"media: pwc: Return queued buffers on start_streaming() failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pwc: Return queued buffers on start_streaming() failure\n\nThe vb2 framework hands buffers to the driver via buf_queue() before\ncalling start_streaming().  If start_streaming() returns an error\nwithout first returning those buffers via vb2_buffer_done(),\nvb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued\nbuffers leak.\n\npwc's start_streaming() had two early returns that hit this trap:\n-ENODEV when the USB device was already disconnected, and -ERESTARTSYS\nwhen mutex_lock_interruptible() was interrupted by a signal.  Call the\nexisting pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED\nbefore returning (matching the state already used by the\npwc_isoc_init() error path in the same function).\n\nThis mirrors the uvcvideo fix in commit 4cf3b6fd54eb (\"media: uvcvideo:\nReturn queued buffers on start_streaming() failure\").","state":0,"publishedAt":"2026-08-10T12:00:35.592+00:00","modifiedAt":"2026-10-19T20:58:57.523+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/media/usb/pwc/pwc-if.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478\",\n                            \"lessThan\": \"d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478\",\n                            \"lessThan\": \"0362ae30b61b3053ee3095c1b8f179197ec4f539\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478\",\n                            \"lessThan\": \"fa78e590852751d3ad32f33f6b4e210fe6ccbe9b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478\",\n                            \"lessThan\": \"f2f9fcacd81953dde6cb86312ab13ca13e689664\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478\",\n                            \"lessThan\": \"5d7cc2634c3843a1414a0f6407aa17f1f91dee60\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478\",\n                            \"lessThan\": \"cb16b79a2be2cec9c3ebe4147490817c4d8b1de3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478\",\n                            \"lessThan\": \"a4f8f629983f643333e49df90557805469bcbb25\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478\",\n                            \"lessThan\": \"975b2ee20e569d47821e4f6c9761b4664d48a6a4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/media/usb/pwc/pwc-if.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.5\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.265\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.148\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.101\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.42\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3","https://git.kernel.org/stable/c/0362ae30b61b3053ee3095c1b8f179197ec4f539","https://git.kernel.org/stable/c/fa78e590852751d3ad32f33f6b4e210fe6ccbe9b","https://git.kernel.org/stable/c/f2f9fcacd81953dde6cb86312ab13ca13e689664","https://git.kernel.org/stable/c/5d7cc2634c3843a1414a0f6407aa17f1f91dee60","https://git.kernel.org/stable/c/cb16b79a2be2cec9c3ebe4147490817c4d8b1de3","https://git.kernel.org/stable/c/a4f8f629983f643333e49df90557805469bcbb25","https://git.kernel.org/stable/c/975b2ee20e569d47821e4f6c9761b4664d48a6a4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68216","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68216","identifiers":["CVE-2026-68216"]},"retained":false,"historicalAffected":[]}],"coverage":[]}