High 7.8Published Aug 10, 2026

CVE-2026-68216media: pwc: Return queued buffers on start_streaming() failure

Updated under an hour ago (Oct 27, 2026, 2:50 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: media: pwc: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. pwc's start_streaming() had two early returns that hit this trap: -ENODEV when the USB device was already disconnected, and -ERESTARTSYS when mutex_lock_interruptible() was interrupted by a signal. Call the existing pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED before returning (matching the state already used by the pwc_isoc_init() error path in the same function). This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-401
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3; from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before 0362ae30b61b3053ee3095c1b8f179197ec4f539; from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before fa78e590852751d3ad32f33f6b4e210fe6ccbe9b; from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before f2f9fcacd81953dde6cb86312ab13ca13e689664; from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before 5d7cc2634c3843a1414a0f6407aa17f1f91dee60; from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before cb16b79a2be2cec9c3ebe4147490817c4d8b1de3; from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before a4f8f629983f643333e49df90557805469bcbb25; from ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 before 975b2ee20e569d47821e4f6c9761b4664d48a6a4	CNA record

References

References

https://git.kernel.org/stable/c/d552852bf76b7dfb35b4593fc874d8dd2f1b1bf3
https://git.kernel.org/stable/c/0362ae30b61b3053ee3095c1b8f179197ec4f539
https://git.kernel.org/stable/c/fa78e590852751d3ad32f33f6b4e210fe6ccbe9b
https://git.kernel.org/stable/c/f2f9fcacd81953dde6cb86312ab13ca13e689664
https://git.kernel.org/stable/c/5d7cc2634c3843a1414a0f6407aa17f1f91dee60
https://git.kernel.org/stable/c/cb16b79a2be2cec9c3ebe4147490817c4d8b1de3
https://git.kernel.org/stable/c/a4f8f629983f643333e49df90557805469bcbb25
https://git.kernel.org/stable/c/975b2ee20e569d47821e4f6c9761b4664d48a6a4

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.