CVE-2026-68217 (GCVE-0-2026-68217)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:00 – Updated: 2026-08-19 16:31
VLAI
Title
media: pwc: Drain fill_buf on start_streaming() failure
Summary
In the Linux kernel, the following vulnerability has been resolved: media: pwc: Drain fill_buf on start_streaming() failure pwc_isoc_init() submits its isochronous URBs with usb_submit_urb(.., GFP_KERNEL) in a loop. After the first URB is submitted, its completion handler pwc_isoc_handler() can run on another CPU before the loop finishes: start_streaming() pwc_isoc_init() usb_submit_urb(urbs[0], GFP_KERNEL) pwc_isoc_handler(urbs[0]) pdev->fill_buf = pwc_get_next_fill_buf(pdev) usb_submit_urb(urbs[i>0], ..) -> fails pwc_isoc_cleanup(pdev) /* kills URBs */ return ret; pwc_cleanup_queued_bufs(pdev, VB2_BUF_STATE_QUEUED) pwc_get_next_fill_buf() detaches a buffer from pdev->queued_bufs and stores it in pdev->fill_buf. The error path in start_streaming() only drains pdev->queued_bufs, so the buffer parked in pdev->fill_buf is leaked. vb2_start_streaming() then triggers WARN_ON(owned_by_drv_count). stop_streaming() already handles this since commit 80b0963e1698 ("[media] pwc: fix WARN_ON"), which added the fill_buf drain in the teardown path but not in the start_streaming() error path. Mirror that handling on failure so start_streaming() returns with no buffer owned by the driver. Issue identified by automated review of the INV-003 series at https://sashiko.dev/
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 885fe18f5542fe283a17f70583383c6cadcba1c3 , < 97f3c15957ec7e6d249f05407ad947c0644df24d (git)
Affected: 885fe18f5542fe283a17f70583383c6cadcba1c3 , < a4afffd148991a826e8995362fb10cf8705c1130 (git)
Affected: 885fe18f5542fe283a17f70583383c6cadcba1c3 , < eabe9a59640698137d7382d5b549e95dc37f7565 (git)
Affected: 885fe18f5542fe283a17f70583383c6cadcba1c3 , < a56e7641e09bd80b976e944ae759109b86fd5b38 (git)
Affected: 885fe18f5542fe283a17f70583383c6cadcba1c3 , < acc789b2173070638cad89c2b61d33ed338be0dd (git)
Affected: 885fe18f5542fe283a17f70583383c6cadcba1c3 , < 9afd605dcd96c7a45f338eded1de16679b30e1df (git)
Affected: 885fe18f5542fe283a17f70583383c6cadcba1c3 , < 5d4812668b03f823b5044789d6aa77fe56b42587 (git)
Affected: 885fe18f5542fe283a17f70583383c6cadcba1c3 , < 906e410dcffbbd99fb4081abab817a830033aa28 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.1
Unaffected: 0 , < 3.1 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/usb/pwc/pwc-if.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "97f3c15957ec7e6d249f05407ad947c0644df24d",
              "status": "affected",
              "version": "885fe18f5542fe283a17f70583383c6cadcba1c3",
              "versionType": "git"
            },
            {
              "lessThan": "a4afffd148991a826e8995362fb10cf8705c1130",
              "status": "affected",
              "version": "885fe18f5542fe283a17f70583383c6cadcba1c3",
              "versionType": "git"
            },
            {
              "lessThan": "eabe9a59640698137d7382d5b549e95dc37f7565",
              "status": "affected",
              "version": "885fe18f5542fe283a17f70583383c6cadcba1c3",
              "versionType": "git"
            },
            {
              "lessThan": "a56e7641e09bd80b976e944ae759109b86fd5b38",
              "status": "affected",
              "version": "885fe18f5542fe283a17f70583383c6cadcba1c3",
              "versionType": "git"
            },
            {
              "lessThan": "acc789b2173070638cad89c2b61d33ed338be0dd",
              "status": "affected",
              "version": "885fe18f5542fe283a17f70583383c6cadcba1c3",
              "versionType": "git"
            },
            {
              "lessThan": "9afd605dcd96c7a45f338eded1de16679b30e1df",
              "status": "affected",
              "version": "885fe18f5542fe283a17f70583383c6cadcba1c3",
              "versionType": "git"
            },
            {
              "lessThan": "5d4812668b03f823b5044789d6aa77fe56b42587",
              "status": "affected",
              "version": "885fe18f5542fe283a17f70583383c6cadcba1c3",
              "versionType": "git"
            },
            {
              "lessThan": "906e410dcffbbd99fb4081abab817a830033aa28",
              "status": "affected",
              "version": "885fe18f5542fe283a17f70583383c6cadcba1c3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/usb/pwc/pwc-if.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.1"
            },
            {
              "lessThan": "3.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: pwc: Drain fill_buf on start_streaming() failure\n\npwc_isoc_init() submits its isochronous URBs with\nusb_submit_urb(.., GFP_KERNEL) in a loop. After the first URB is\nsubmitted, its completion handler pwc_isoc_handler() can run on another\nCPU before the loop finishes:\n\n  start_streaming()\n    pwc_isoc_init()\n      usb_submit_urb(urbs[0], GFP_KERNEL)\n                                  pwc_isoc_handler(urbs[0])\n                                    pdev-\u003efill_buf =\n                                      pwc_get_next_fill_buf(pdev)\n      usb_submit_urb(urbs[i\u003e0], ..)  -\u003e fails\n      pwc_isoc_cleanup(pdev)           /* kills URBs */\n      return ret;\n    pwc_cleanup_queued_bufs(pdev, VB2_BUF_STATE_QUEUED)\n\npwc_get_next_fill_buf() detaches a buffer from pdev-\u003equeued_bufs and\nstores it in pdev-\u003efill_buf. The error path in start_streaming() only\ndrains pdev-\u003equeued_bufs, so the buffer parked in pdev-\u003efill_buf is\nleaked. vb2_start_streaming() then triggers\nWARN_ON(owned_by_drv_count).\n\nstop_streaming() already handles this since commit 80b0963e1698\n(\"[media] pwc: fix WARN_ON\"), which added the fill_buf drain in the\nteardown path but not in the start_streaming() error path. Mirror that\nhandling on failure so start_streaming() returns with no buffer owned\nby the driver.\n\nIssue identified by automated review of the INV-003 series at\nhttps://sashiko.dev/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:31:48.858Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/97f3c15957ec7e6d249f05407ad947c0644df24d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a4afffd148991a826e8995362fb10cf8705c1130"
        },
        {
          "url": "https://git.kernel.org/stable/c/eabe9a59640698137d7382d5b549e95dc37f7565"
        },
        {
          "url": "https://git.kernel.org/stable/c/a56e7641e09bd80b976e944ae759109b86fd5b38"
        },
        {
          "url": "https://git.kernel.org/stable/c/acc789b2173070638cad89c2b61d33ed338be0dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/9afd605dcd96c7a45f338eded1de16679b30e1df"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d4812668b03f823b5044789d6aa77fe56b42587"
        },
        {
          "url": "https://git.kernel.org/stable/c/906e410dcffbbd99fb4081abab817a830033aa28"
        }
      ],
      "title": "media: pwc: Drain fill_buf on start_streaming() failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68217",
    "datePublished": "2026-08-10T12:00:36.773Z",
    "dateReserved": "2026-07-30T09:28:09.375Z",
    "dateUpdated": "2026-08-19T16:31:48.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68217",
      "date": "2026-08-20",
      "epss": "0.0022",
      "percentile": "0.12745"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68217\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:09.657\",\"lastModified\":\"2026-08-19T17:20:37.867\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmedia: pwc: Drain fill_buf on start_streaming() failure\\n\\npwc_isoc_init() submits its isochronous URBs with\\nusb_submit_urb(.., GFP_KERNEL) in a loop. After the first URB is\\nsubmitted, its completion handler pwc_isoc_handler() can run on another\\nCPU before the loop finishes:\\n\\n  start_streaming()\\n    pwc_isoc_init()\\n      usb_submit_urb(urbs[0], GFP_KERNEL)\\n                                  pwc_isoc_handler(urbs[0])\\n                                    pdev-\u003efill_buf =\\n                                      pwc_get_next_fill_buf(pdev)\\n      usb_submit_urb(urbs[i\u003e0], ..)  -\u003e fails\\n      pwc_isoc_cleanup(pdev)           /* kills URBs */\\n      return ret;\\n    pwc_cleanup_queued_bufs(pdev, VB2_BUF_STATE_QUEUED)\\n\\npwc_get_next_fill_buf() detaches a buffer from pdev-\u003equeued_bufs and\\nstores it in pdev-\u003efill_buf. The error path in start_streaming() only\\ndrains pdev-\u003equeued_bufs, so the buffer parked in pdev-\u003efill_buf is\\nleaked. vb2_start_streaming() then triggers\\nWARN_ON(owned_by_drv_count).\\n\\nstop_streaming() already handles this since commit 80b0963e1698\\n(\\\"[media] pwc: fix WARN_ON\\\"), which added the fill_buf drain in the\\nteardown path but not in the start_streaming() error path. Mirror that\\nhandling on failure so start_streaming() returns with no buffer owned\\nby the driver.\\n\\nIssue identified by automated review of the INV-003 series at\\nhttps://sashiko.dev/\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/media/usb/pwc/pwc-if.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"885fe18f5542fe283a17f70583383c6cadcba1c3\",\"lessThan\":\"97f3c15957ec7e6d249f05407ad947c0644df24d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"885fe18f5542fe283a17f70583383c6cadcba1c3\",\"lessThan\":\"a4afffd148991a826e8995362fb10cf8705c1130\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"885fe18f5542fe283a17f70583383c6cadcba1c3\",\"lessThan\":\"eabe9a59640698137d7382d5b549e95dc37f7565\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"885fe18f5542fe283a17f70583383c6cadcba1c3\",\"lessThan\":\"a56e7641e09bd80b976e944ae759109b86fd5b38\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"885fe18f5542fe283a17f70583383c6cadcba1c3\",\"lessThan\":\"acc789b2173070638cad89c2b61d33ed338be0dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"885fe18f5542fe283a17f70583383c6cadcba1c3\",\"lessThan\":\"9afd605dcd96c7a45f338eded1de16679b30e1df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"885fe18f5542fe283a17f70583383c6cadcba1c3\",\"lessThan\":\"5d4812668b03f823b5044789d6aa77fe56b42587\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"885fe18f5542fe283a17f70583383c6cadcba1c3\",\"lessThan\":\"906e410dcffbbd99fb4081abab817a830033aa28\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/media/usb/pwc/pwc-if.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5d4812668b03f823b5044789d6aa77fe56b42587\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/906e410dcffbbd99fb4081abab817a830033aa28\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/97f3c15957ec7e6d249f05407ad947c0644df24d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9afd605dcd96c7a45f338eded1de16679b30e1df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a4afffd148991a826e8995362fb10cf8705c1130\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a56e7641e09bd80b976e944ae759109b86fd5b38\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/acc789b2173070638cad89c2b61d33ed338be0dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/eabe9a59640698137d7382d5b549e95dc37f7565\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-13T22:53:40+00:00",
      "cve": "CVE-2026-68217",
      "id": "CVE-2026-68217",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "261",
      "product_status:known_not_affected": "15",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: pwc: Drain fill_buf on start_streaming() failure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68217.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-14T00:53:10Z",
      "cve": "CVE-2026-68217",
      "id": "CVE-2026-68217",
      "initial_release_date": "2026-08-13T16:22:45Z",
      "product_status:known_affected": "205",
      "product_status:known_not_affected": "91",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68217",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68217.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.