Cloudanix VulnDB

CVE-2026-68211

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain Linux video capture drivers could cause warnings or lost resources when starting a video stream fails.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to return queued vb2 buffers via vb2_buffer_done() on start_streaming() error in stm32-dcmipp causes WARN_ON(owned_by_drv_count) and buffer leak.

Why it matters to the business

Media capture hardware on affected Linux systems may trigger kernel warnings or resource leaks during streaming initialization, reducing stability for video applications.

How an attack unfolds

An attacker with local access triggers the error path in dcmipp_bytecap_start_streaming() by causing media graph resolution to fail before pipeline setup, leading to the leak condition.

How to fix it

Apply the upstream fix that jumps directly to the err_buffer_done label on early start_streaming failure; rebuild and deploy the patched kernel.

How to confirm the fix worked

Verify the presence of the err_buffer_done jump in dcmipp_bytecap_start_streaming(); monitor kernel logs for absence of owned_by_drv_count warnings during simulated failure paths.

Typical attack path

  1. Obtain local access to the system
  2. Configure or manipulate the media graph to force subdevice resolution failure
  3. Initiate streaming to hit the buggy error path
  4. Observe kernel warning and leaked buffers

How to detect it

Search kernel logs for WARN_ON messages referencing owned_by_drv_count or vb2_start_streaming failures; inspect dmesg around media device open attempts.

What your security team should do

  • Prioritize kernel update for systems using stm32-dcmipp media drivers
  • Review media pipeline error handling in custom drivers for similar patterns
  • Monitor kernel logs for vb2 framework warnings

The record

In the Linux kernel, the following vulnerability has been resolved: media: stm32-dcmipp: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. dcmipp_bytecap_start_streaming() returned -EINVAL when the source subdevice could not be resolved from the media graph, before pm_runtime_resume_and_get() and media_pipeline_start() had been called. The remaining error paths already converge on the err_buffer_done label, which calls dcmipp_bytecap_all_buffers_done(..., VB2_BUF_STATE_QUEUED). Jump to that label directly: the intermediate err_pm_put / err_media_pipeline_stop labels are skipped, which is correct because nothing they would undo has happened yet. This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").

Affected packages

Ecosystem Package Introduced Fixed