A bug in the Linux kernel media uvcvideo driver causes queued video buffers to be incorrectly returned when start_streaming() fails because uvc_pm_get() encounters an error. The improper error handling can lead to kernel warnings, device disconnects, and potentially system instability or halt for connected USB video devices. The vulnerability does not provide a direct attack vector for code execution or privilege escalation; its impact is limited to denial of service or device malfunction on systems that use the affected driver.

All Linux kernel builds that include the uvcvideo driver prior to the commit fixed in the referenced patch URLs. Specific affected kernel versions are not listed here, but any kernel following the paths in the provided git commits is likely impacted.

The CVSS score is 5.5, and the EPSS score is unavailable, indicating there is no known high exploitation probability. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is local, requiring access to the USB video device interface; it would need an attacker with physical or elevated local access to trigger the failure scenario. Because the flaw only impacts device stability rather than confidentiality or integrity, the overall risk is moderate and can be mitigated by applying the upstream patch.