CVE-2026-68216 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
media: pwc: Return queued buffers on start_streaming() failure
The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak.
pwc's start_streaming() had two early returns that hit this trap: -ENODEV when the USB device was already disconnected, and -ERESTARTSYS when mutex_lock_interruptible() was interrupted by a signal. Call the existing pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED before returning (matching the state already used by the pwc_isoc_init() error path in the same function).
This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability resides within the linux kernel's pwc media driver which handles Philips Webcam (pwc) devices. This issue demonstrates a critical buffer management flaw that occurs during the video streaming initialization process. The problem emerges from improper handling of queued buffers when the start_streaming() function fails, creating a scenario where driver resources become permanently unavailable and system stability is compromised.
The technical root cause involves the vb2 framework's buffer queueing mechanism where buffers are handed to the driver through buf_queue() before start_streaming() is invoked. When start_streaming() encounters an error condition without properly returning these queued buffers back to the vb2 subsystem via vb2_buffer_done(), the framework's internal accounting becomes inconsistent. This inconsistency triggers a WARN_ON(owned_by_drv_count) assertion that indicates a fundamental mismatch in buffer ownership tracking, leading to resource leakage.
The specific failure conditions identified in the pwc driver include two early return scenarios that activate this problematic code path: -ENODEV error when the USB device has been disconnected and -ERESTARTSYS when mutex_lock_interruptible() is interrupted by a signal. Both of these conditions represent legitimate error cases that should not result in buffer leaks or system instability. The vulnerability manifests as a resource leak where buffers remain in a queued state but are never properly released back to the framework, causing memory consumption to grow unbounded.
This flaw directly relates to CWE-404, which addresses improper resource management and the CWE-755 category for improper handling of exceptional conditions. The issue demonstrates poor error recovery practices within the driver's streaming initialization sequence and represents a classic example of resource leak vulnerabilities in kernel space programming. From an operational perspective, this vulnerability could lead to progressive memory exhaustion on systems running pwc drivers under heavy load or frequent device disconnections.
The fix implements a targeted solution by calling the existing pwc_cleanup_queued_bufs() helper function with VB2_BUF_STATE_QUEUED before returning from start_streaming(). This approach ensures proper buffer state management and mirrors the established pattern used elsewhere in the same function within pwc_isoc_init(). The mitigation strategy aligns with industry best practices for kernel driver development and follows the precedent set by a similar fix in the uvcvideo driver, demonstrating the importance of consistent error handling patterns across related subsystems.
The operational impact extends beyond simple memory leaks to potentially affect system reliability during device hot-plugging scenarios or when devices experience transient connection issues. This vulnerability could be exploited in denial-of-service attacks where repeated streaming initialization failures cause progressive resource exhaustion. The fix addresses this through proper buffer state management and ensures that all queued buffers are properly returned to the vb2 framework regardless of the error condition encountered. System administrators should prioritize applying this patch, particularly on systems with multiple pwc devices or those operating in environments where USB device disconnections are common.