CVE-2026-68211
Received Received - Intake

Buffer Leak in STM32 DCMIPP Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: media: stm32-dcmipp: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. dcmipp_bytecap_start_streaming() returned -EINVAL when the source subdevice could not be resolved from the media graph, before pm_runtime_resume_and_get() and media_pipeline_start() had been called. The remaining error paths already converge on the err_buffer_done label, which calls dcmipp_bytecap_all_buffers_done(..., VB2_BUF_STATE_QUEUED). Jump to that label directly: the intermediate err_pm_put / err_media_pipeline_stop labels are skipped, which is correct because nothing they would undo has happened yet. This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68211
EUVD
EUVD-2026-55312

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's media subsystem, specifically in the stm32-dcmipp driver. It occurs when the start_streaming() function fails after buffers have been queued but not properly returned. The vb2 framework passes buffers to the driver before calling start_streaming(). If start_streaming() fails without returning these buffers via vb2_buffer_done(), the buffers leak and trigger a warning in vb2_start_streaming().

Detection Guidance

This vulnerability is specific to the Linux kernel's media subsystem, particularly the stm32-dcmipp driver. Detection requires checking kernel logs for errors related to buffer handling in the media framework. Use commands like 'dmesg | grep -i dcmipp' or 'journalctl -k | grep -i dcmipp' to search for relevant errors.

Impact Analysis

This vulnerability could lead to buffer leaks in the Linux kernel's media subsystem, potentially causing system instability or resource exhaustion. It may affect applications relying on media capture or processing, such as video recording or streaming software, by disrupting normal operation or causing crashes.

Mitigation Strategies

Update the Linux kernel to a patched version where this vulnerability is resolved. Monitor kernel logs for errors related to the stm32-dcmipp driver after applying updates. If the driver is not in use, consider disabling it via kernel module blacklisting.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68211. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart