CVE-2026-68217

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: pwc: Drain fill_buf on start_streaming() failure

pwc_isoc_init() submits its isochronous URBs with

usb_submit_urb(.., GFP_KERNEL) in a loop. After the first URB is

submitted, its completion handler pwc_isoc_handler() can run on another

CPU before the loop finishes:

start_streaming()

pwc_isoc_init()

usb_submit_urb(urbs[0], GFP_KERNEL)

pwc_isoc_handler(urbs[0])

pdev->fill_buf =

pwc_get_next_fill_buf(pdev)

usb_submit_urb(urbs[i>0], ..) -> fails

pwc_isoc_cleanup(pdev) /* kills URBs */

return ret;

pwc_cleanup_queued_bufs(pdev, VB2_BUF_STATE_QUEUED)

pwc_get_next_fill_buf() detaches a buffer from pdev->queued_bufs and

stores it in pdev->fill_buf. The error path in start_streaming() only

drains pdev->queued_bufs, so the buffer parked in pdev->fill_buf is

leaked. vb2

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References