CVE-2026-68216
Received Received - Intake

Memory Leak in Linux Kernel pwc Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: media: pwc: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. pwc's start_streaming() had two early returns that hit this trap: -ENODEV when the USB device was already disconnected, and -ERESTARTSYS when mutex_lock_interruptible() was interrupted by a signal. Call the existing pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED before returning (matching the state already used by the pwc_isoc_init() error path in the same function). This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68216
EUVD
EUVD-2026-55317

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel pwc *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel affects the pwc media driver. When the start_streaming() function fails, queued video buffers are not properly returned, causing them to leak. This happens due to early returns in start_streaming() when the USB device is disconnected or a signal interrupts a mutex lock.

Detection Guidance

This vulnerability is specific to the Linux kernel's media subsystem, particularly the pwc (Philips Webcam) driver. Detection requires checking kernel logs for errors related to pwc or media subsystem failures during streaming initialization. Commands like dmesg | grep pwc or journalctl -k | grep pwc may reveal issues. Ensure your kernel version is updated to a patched release.

Impact Analysis

If exploited, this flaw could lead to resource exhaustion, causing system instability or crashes. Users may experience video capture failures or system hangs when using pwc-based USB webcams.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If using a distribution kernel, apply vendor patches promptly. Avoid using the pwc driver for Philips Webcams until patched. Monitor kernel logs for errors after updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68216. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart