Technical impact
A defect in the Linux kernel media UVC video driver causes queued video buffers to be returned when start_streaming() fails because uvc_pm_get() encounters an error. The improper error handling generates kernel warnings, forces the xHCI controller to abort the USB transfer, and can lead to device disconnections or temporary system instability. The impact is limited to denial of service or interruption of video stream functionality on systems that use this driver; it does not provide a path to code execution or privilege escalation.
Affected Systems
All Linux kernel builds that include the uvcvideo driver before the patch referenced in the supplied git commits are affected. No specific kernel versions are listed in the advisory, so any kernel that incorporates the driver and has not incorporated the commit sequence containing the fix is considered vulnerable.
Risk and Exploitability
The CVSS score of 7.8 and the EPSS score of less than 1% illustrate a moderate severity but a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is most likely local and requires access to the attached USB video device, either through physical presence or elevated local privileges. Because the flaw only disrupts device operation and does not compromise confidentiality or integrity, the overall risk is moderate and can be mitigated by applying the upstream patch.
