CVE-2026-68216

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-68216

Key Details

CVE	CVE-2026-68216
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

media: pwc: Return queued buffers on start_streaming() failure

The vb2 framework hands buffers to the driver via buf_queue() before

calling start_streaming(). If start_streaming() returns an error

without first returning those buffers via vb2_buffer_done(),

vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued

buffers leak.

pwc's start_streaming() had two early returns that hit this trap:

-ENODEV when the USB device was already disconnected, and -ERESTARTSYS

when mutex_lock_interruptible() was interrupted by a signal. Call the

existing pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED

before returning (matching the state already used by the

pwc_isoc_init() error path in the same function).

This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo:

Return queued buffers on start_streaming() failure"). (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-68216
CVE	https://www.cve.org/CVERecord?id=CVE-2026-68216

Source

Reference

NVD

CVE