Cloudanix VulnDB

CVE-2026-68217

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in Linux webcam handling can leave video data stranded and produce error warnings when starting video capture on certain devices.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in pwc USB webcam driver leaks a video buffer in fill_buf when usb_submit_urb fails after the first URB submission during start_streaming, bypassing the queued_bufs drain and triggering WARN_ON(owned_by_drv_count).

Why it matters to the business

Low-severity driver instability on systems using affected webcams, with minimal operational disruption and no known active exploitation or ransomware use.

How an attack unfolds

An attacker with local access attaches a pwc-compatible device and induces a USB URB submission failure after the initial submission, causing the buffer leak; the flaw was identified via automated review rather than in-the-wild attacks by named actors.

How to fix it

Apply the upstream kernel fix that adds fill_buf drain in the start_streaming error path, mirroring the existing stop_streaming handling.

How to confirm the fix worked

Reproduce start_streaming failure scenarios with pwc devices and confirm absence of WARN_ON(owned_by_drv_count) and no leaked buffers in fill_buf after patch.

Typical attack path

  1. Obtain local system access
  2. Connect pwc-compatible webcam hardware
  3. Trigger start_streaming error path via USB submission failure after first URB
  4. Observe buffer leak and kernel warning

How to detect it

Search kernel logs and dmesg for WARN_ON messages referencing owned_by_drv_count or pwc buffer handling on systems with pwc driver loaded.

What your security team should do

  • Prioritize kernel updates containing the pwc start_streaming fix on systems with webcam support
  • Review dmesg and kernel logs for related warnings on affected hardware
  • Monitor EPSS and KEV status for any future changes indicating increased risk

The record

In the Linux kernel, the following vulnerability has been resolved: media: pwc: Drain fill_buf on start_streaming() failure pwc_isoc_init() submits its isochronous URBs with usb_submit_urb(.., GFP_KERNEL) in a loop. After the first URB is submitted, its completion handler pwc_isoc_handler() can run on another CPU before the loop finishes: start_streaming() pwc_isoc_init() usb_submit_urb(urbs[0], GFP_KERNEL) pwc_isoc_handler(urbs[0]) pdev->fill_buf = pwc_get_next_fill_buf(pdev) usb_submit_urb(urbs[i>0], ..) -> fails pwc_isoc_cleanup(pdev) /* kills URBs */ return ret; pwc_cleanup_queued_bufs(pdev, VB2_BUF_STATE_QUEUED) pwc_get_next_fill_buf() detaches a buffer from pdev->queued_bufs and stores it in pdev->fill_buf. The error path in start_streaming() only drains pdev->queued_bufs, so the buffer parked in pdev->fill_buf is leaked. vb2_start_streaming() then triggers WARN_ON(owned_by_drv_count). stop_streaming() already handles this since commit 80b0963e1698 ("[media] pwc: fix WARN_ON"), which added the fill_buf drain in the teardown path but not in the start_streaming() error path. Mirror that handling on failure so start_streaming() returns with no buffer owned by the driver. Issue identified by automated review of the INV-003 series at https://sashiko.dev/

Affected packages

Ecosystem Package Introduced Fixed