{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-68216", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.375Z", "datePublished": "2026-08-10T12:00:35.592Z", "dateUpdated": "2026-08-19T16:31:47.114Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:31:47.114Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pwc: Return queued buffers on start_streaming() failure\n\nThe vb2 framework hands buffers to the driver via buf_queue() before\ncalling start_streaming(). If start_streaming() returns an error\nwithout first returning those buffers via vb2_buffer_done(),\nvb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued\nbuffers leak.\n\npwc's start_streaming() had two early returns that hit this trap:\n-ENODEV when the USB device was already disconnected, and -ERESTARTSYS\nwhen mutex_lock_interruptible() was interrupted by a signal. Call the\nexisting pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED\nbefore returning (matching the state already used by the\npwc_isoc_init() error path in the same function).\n\nThis mirrors the uvcvideo fix in commit 4cf3b6fd54eb (\"media: uvcvideo:\nReturn queued buffers on start_streaming() failure\")." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is reached through the VIDIOC_STREAMON ioctl on a local V4L2 device node (/dev/videoN) exposed by the pwc USB webcam driver, so the attacker needs local access to the system rather than network reachability.\nAC:L - The -ERESTARTSYS path is triggered deterministically by the attacker: hold pdev->v4l2_lock from a second thread/fd and send a signal to the thread blocked in mutex_lock_interruptible() inside start_streaming(), so both sides of the timing window are attacker-controlled and repeatable.\nPR:L - Only an unprivileged local account with access to the video device node (typical for desktop, kiosk and embedded video appliances, where the video group or logind ACLs grant it) is needed; no capabilities or root are required.\nUI:N - The attacker performs the entire sequence (REQBUFS, QBUF, STREAMON, signal delivery) from its own process; no action by any other user is needed.\nS:U - The buffer-accounting breakage and the resulting list corruption stay within the kernel's own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - Buffers left on pdev->queued_bufs after vb2 has already reclaimed them to QUEUED are re-linked on the next STREAMON, so the same pwc_frame_buf can be filled and completed while vb2 considers it userspace-owned, allowing an attacker to read kernel-managed frame data through stale mmap'ed buffers.\nI:H - The double list_add_tail() of an already-linked buf->list node corrupts the driver's queued-buffer list and desynchronizes vb2's owned_by_drv_count, giving overlapping kernel/userspace ownership of buffer objects that can be leveraged for controlled modification of kernel-side state.\nA:H - Each attempt fires WARN_ON(owned_by_drv_count) in vb2_start_streaming(), which panics the machine on panic_on_warn kernels, and the leaked/corrupted buffer list additionally leads to lost buffers and unstable streaming state on subsequent STREAMON/STREAMOFF cycles." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/usb/pwc/pwc-if.c" ], "versions": [ { "version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478", "lessThan": "d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3", "status": "affected", "versionType": "git" }, { "version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478", "lessThan": "0362ae30b61b3053ee3095c1b8f179197ec4f539", "status": "affected", "versionType": "git" }, { "version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478", "lessThan": "fa78e590852751d3ad32f33f6b4e210fe6ccbe9b", "status": "affected", "versionType": "git" }, { "version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478", "lessThan": "f2f9fcacd81953dde6cb86312ab13ca13e689664", "status": "affected", "versionType": "git" }, { "version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478", "lessThan": "5d7cc2634c3843a1414a0f6407aa17f1f91dee60", "status": "affected", "versionType": "git" }, { "version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478", "lessThan": "cb16b79a2be2cec9c3ebe4147490817c4d8b1de3", "status": "affected", "versionType": "git" }, { "version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478", "lessThan": "a4f8f629983f643333e49df90557805469bcbb25", "status": "affected", "versionType": "git" }, { "version": "ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478", "lessThan": "975b2ee20e569d47821e4f6c9761b4664d48a6a4", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/media/usb/pwc/pwc-if.c" ], "versions": [ { "version": "3.5", "status": "affected" }, { "version": "0", "lessThan": "3.5", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "5.10.265" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "5.15.216" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.1.183" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.6.148" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.12.101" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "6.18.42" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "7.1.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.5", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3" }, { "url": "https://git.kernel.org/stable/c/0362ae30b61b3053ee3095c1b8f179197ec4f539" }, { "url": "https://git.kernel.org/stable/c/fa78e590852751d3ad32f33f6b4e210fe6ccbe9b" }, { "url": "https://git.kernel.org/stable/c/f2f9fcacd81953dde6cb86312ab13ca13e689664" }, { "url": "https://git.kernel.org/stable/c/5d7cc2634c3843a1414a0f6407aa17f1f91dee60" }, { "url": "https://git.kernel.org/stable/c/cb16b79a2be2cec9c3ebe4147490817c4d8b1de3" }, { "url": "https://git.kernel.org/stable/c/a4f8f629983f643333e49df90557805469bcbb25" }, { "url": "https://git.kernel.org/stable/c/975b2ee20e569d47821e4f6c9761b4664d48a6a4" } ], "title": "media: pwc: Return queued buffers on start_streaming() failure", "x_generator": { "engine": "bippy-1.2.0" } } } }