Cloudanix VulnDB

CVE-2026-68216

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux camera driver code can cause warnings and lost resources when video streaming fails to start properly.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Failure to return queued video buffers via vb2_buffer_done on start_streaming errors in the pwc USB camera driver causes vb2 framework to hit WARN_ON(owned_by_drv_count) and leaks the buffers.

Why it matters to the business

Kernel warnings and potential resource exhaustion on systems using Philips USB webcams can lead to video capture instability or require reboots in affected Linux deployments.

How an attack unfolds

An attacker with local access triggers the pwc start_streaming error paths (USB disconnect or signal interruption during mutex acquisition) to induce the buffer leak and associated warning, but no remote or unauthenticated paths are known.

How to fix it

Update the Linux kernel to a version containing the fix that calls pwc_cleanup_queued_bufs before returning from the error paths in start_streaming.

How to confirm the fix worked

Confirm the presence of the pwc_cleanup_queued_bufs call with VB2_BUF_STATE_QUEUED in start_streaming error paths and absence of the WARN_ON after simulated failures.

Typical attack path

  1. Obtain local access to a Linux system with a pwc-based USB camera
  2. Initiate video streaming via userspace application using the driver
  3. Force an early error in start_streaming by disconnecting the device or delivering a signal
  4. Observe kernel warning and leaked buffers

How to detect it

Search kernel logs for vb2 WARN_ON messages mentioning owned_by_drv_count or pwc start_streaming errors; inspect USB device removal and signal handling around video4linux device nodes.

What your security team should do

  • Prioritize kernel updates on systems exposing pwc video devices
  • Monitor for kernel warnings related to vb2 owned_by_drv_count
  • Limit untrusted local access on multi-user systems using affected hardware

The record

In the Linux kernel, the following vulnerability has been resolved: media: pwc: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. pwc's start_streaming() had two early returns that hit this trap: -ENODEV when the USB device was already disconnected, and -ERESTARTSYS when mutex_lock_interruptible() was interrupted by a signal. Call the existing pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED before returning (matching the state already used by the pwc_isoc_init() error path in the same function). This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").

Affected packages

Ecosystem Package Introduced Fixed