CVE-2026-68222

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

media: msi2500: Return queued buffers on start_streaming() failure

The vb2 framework hands buffers to the driver via buf_queue() before

calling start_streaming(). If start_streaming() returns an error

without first returning those buffers via vb2_buffer_done(),

vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued

buffers leak.

msi2500_start_streaming() had five error paths that all hit this trap

and were further tangled by ret-overwriting between calls:

- -ENODEV when the USB device was already disconnected

- -ERESTARTSYS when mutex_lock_interruptible() was interrupted

- msi2500_set_usb_adc() failure: ret was silently overwritten by

the next call (msi2500_isoc_init), so the error was lost entirely

- msi2500_isoc_init() failure: cleanup_queued_bufs was called, but

the function then fell through to msi2500_ctrl_msg() and again

masked the original error by overwriting ret

- msi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References