CVE-2026-68222
Received Received - Intake

Buffer Leak in msi2500 Media Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: media: msi2500: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. msi2500_start_streaming() had five error paths that all hit this trap and were further tangled by ret-overwriting between calls: - -ENODEV when the USB device was already disconnected - -ERESTARTSYS when mutex_lock_interruptible() was interrupted - msi2500_set_usb_adc() failure: ret was silently overwritten by the next call (msi2500_isoc_init), so the error was lost entirely - msi2500_isoc_init() failure: cleanup_queued_bufs was called, but the function then fell through to msi2500_ctrl_msg() and again masked the original error by overwriting ret - msi2500_ctrl_msg(CMD_START_STREAMING) failure: no cleanup at all, leaving isoc URBs submitted with no way for the driver to consume them Consolidate the error paths into a small goto chain. Every failure now stops the function, drains the queued-buffer list, and returns the real error code. The ctrl_msg failure path also rolls back the preceding msi2500_isoc_init() via msi2500_isoc_cleanup() before unlocking and draining. The cleanup helper takes a vb2_buffer_state argument so that the start_streaming error paths can pass VB2_BUF_STATE_QUEUED (as expected by userspace on start_streaming failure) while stop_streaming keeps its existing VB2_BUF_STATE_ERROR semantics. This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68222
EUVD
EUVD-2026-55323

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Linux kernel's media subsystem, specifically the msi2500 driver. It occurs when start_streaming() fails but queued buffers are not properly returned to userspace. The vb2 framework hands buffers to the driver before calling start_streaming(), and if start_streaming() returns an error without returning those buffers via vb2_buffer_done(), the buffers leak and a warning is triggered.

Detection Guidance

This vulnerability is specific to the Linux kernel's media subsystem, particularly the msi2500 driver. Detection requires checking kernel logs for errors related to msi2500 or media streaming failures. Use commands like dmesg | grep msi2500 or journalctl -k | grep msi2500 to inspect kernel logs for relevant errors.

Impact Analysis

This vulnerability could lead to buffer leaks and system instability if the msi2500 driver fails during streaming initialization. It may cause unexpected warnings, resource exhaustion, or crashes in systems using this driver for media processing.

Mitigation Strategies

Apply the latest kernel updates from your Linux distribution to ensure the vulnerability is patched. If immediate patching is not possible, consider disabling the msi2500 driver module if not in use. Monitor kernel logs for errors and restrict access to media devices if the driver is required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68222. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart