CVE-2026-68217 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
media: pwc: Drain fill_buf on start_streaming() failure
pwc_isoc_init() submits its isochronous URBs with usb_submit_urb(.., GFP_KERNEL) in a loop. After the first URB is submitted, its completion handler pwc_isoc_handler() can run on another CPU before the loop finishes:
start_streaming() pwc_isoc_init() usb_submit_urb(urbs[0], GFP_KERNEL)
pwc_isoc_handler(urbs[0])
pdev->fill_buf = pwc_get_next_fill_buf(pdev) usb_submit_urb(urbs[i>0], ..) -> fails
pwc_isoc_cleanup(pdev) /* kills URBs */ return ret; pwc_cleanup_queued_bufs(pdev, VB2_BUF_STATE_QUEUED)
pwc_get_next_fill_buf() detaches a buffer from pdev->queued_bufs and stores it in pdev->fill_buf. The error path in start_streaming() only drains pdev->queued_bufs, so the buffer parked in pdev->fill_buf is leaked. vb2_start_streaming() then triggers WARN_ON(owned_by_drv_count).
stop_streaming() already handles this since commit 80b0963e1698 ("[media] pwc: fix WARN_ON"), which added the fill_buf drain in the
teardown path but not in the start_streaming() error path. Mirror that handling on failure so start_streaming() returns with no buffer owned by the driver.
Issue identified by automated review of the INV-003 series at https://sashiko.dev/
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within the Linux kernel's pwc (Philips Webcam) media driver where a race condition during streaming initialization leads to memory resource leakage and potential system instability. The issue occurs specifically in the start_streaming() function when dealing with isochronous USB requests that are submitted using GFP_KERNEL allocation context. When the first URB submission completes before subsequent submissions finish, the completion handler pwc_isoc_handler() executes on a different CPU, creating a timing window where buffer management becomes inconsistent.
The technical flaw stems from the pwc_isoc_init() function's loop structure where URBs are submitted sequentially with kernel memory allocation context. Upon the first URB completion, the pwc_isoc_handler() function executes and calls pwc_get_next_fill_buf() which removes a buffer from the queued_bufs list and assigns it to pdev->fill_buf. However, when subsequent URB submissions fail during start_streaming(), the error handling path only processes the pdev->queued_bufs list for cleanup while leaving the buffer in pdev->fill_buf unaddressed, creating a memory leak scenario.
This vulnerability directly relates to CWE-401: Improper Release of Memory Before Next Referral, where resources are not properly freed when error conditions occur. The operational impact includes potential memory exhaustion over multiple streaming attempts, system instability due to resource leaks, and the triggering of kernel warnings that indicate driver state inconsistency. When vb2_start_streaming() completes with a non-zero return value, it invokes WARN_ON(owned_by_drv_count) which indicates that buffers are still owned by the driver despite the failed initialization.
The mitigation strategy mirrors the existing fix implemented in commit 80b0963e1698 for stop_streaming() operations by ensuring that fill_buf is drained during error paths in start_streaming(). This approach follows ATT&CK technique T1547.001: Registry Run Keys / Startup Folder which emphasizes proper resource cleanup mechanisms. The fix requires implementing buffer drainage logic in the start_streaming() error path to mirror the established pattern used in stop_streaming(), ensuring that all buffers managed by the driver are properly accounted for regardless of initialization success or failure.
The vulnerability demonstrates a classic race condition scenario where asynchronous completion handlers interfere with synchronous initialization sequences. This type of issue is particularly dangerous in real-time media processing contexts where resource management must be predictable and deterministic. The fix ensures that both error paths maintain identical buffer state management, preventing the accumulation of leaked buffers that could eventually lead to system resource exhaustion or unpredictable driver behavior. The automated review process that identified this vulnerability through the INV-003 series demonstrates how systematic code analysis can uncover subtle timing-related issues in complex kernel subsystems.
This flaw represents a failure in proper resource lifecycle management where buffer ownership tracking becomes inconsistent during error conditions. The root cause involves improper synchronization between URB submission completion and initialization error handling, creating a scenario where buffers transition from queued state to driver-owned state without proper cleanup mechanisms for error scenarios. The fix essentially implements defensive programming practices that ensure all allocated resources are properly accounted for in both success and failure paths of the streaming initialization sequence.