CVE-2026-68209 - Vulnerability Details

- media: sun4i-csi: Return queued buffers on start_streaming() failure

Description

In the Linux kernel, the following vulnerability has been resolved:

media: sun4i-csi: Return queued buffers on start_streaming() failure

The vb2 framework hands buffers to the driver via buf_queue() before
calling start_streaming(). If start_streaming() returns an error
without first returning those buffers via vb2_buffer_done(),
vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued
buffers leak.

sun4i_csi_start_streaming() returned -EINVAL when no matching CSI
format could be found, before any setup (scratch buffer allocation,
pipeline start) had been performed. The remaining error paths already
converge on the err_clear_dma_queue label, which calls
return_all_buffers(..., VB2_BUF_STATE_QUEUED) under csi->qlock. Jump
to that label directly: the intermediate err_disable_device /
err_disable_pipeline / err_free_scratch_buffer labels are skipped,
which is correct because nothing they would undo has happened yet.

This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo:
Return queued buffers on start_streaming() failure").

Published: 2026-08-10

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The sun4i_csi media driver in the Linux kernel can leak kernel memory when the start_streaming() operation fails. In that failure path the driver does not return queued buffers to the vb2 framework, leaving them allocated in the kernel space. This flaw is a CWE-772 unreleased resource problem in the driver layer and can consume kernel memory if repeated.

Affected Systems

Linux kernel builds that include the sun4i_csi driver and do not contain the corrective commit 4872161e6fbe4e1783daea8bff79caddfae0fb82 are affected. The vulnerability exists in any kernel version prior to that commit; no specific version range is provided.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, while the EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low likelihood of exploitation. Based on the description, it is inferred that the attack vector is local and would require the ability to trigger a start_streaming() failure, which might be achievable by a local user with access to the relevant media device. The risk is primarily memory exhaustion, potentially leading to system instability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`577bbf23b758848f0c4a50d346460b690c753024`	affected	< 29fce7bcb3b959f6d4fdcdff7d26330152fdf98d
`577bbf23b758848f0c4a50d346460b690c753024`	affected	< 7c2c30e282745a83d332c3cf92d1c0bcc491ac54
`577bbf23b758848f0c4a50d346460b690c753024`	affected	< 3c0bd793b0083fd4639ba7f60d1e7db8c8ac459a
`577bbf23b758848f0c4a50d346460b690c753024`	affected	< 4872161e6fbe4e1783daea8bff79caddfae0fb82
`577bbf23b758848f0c4a50d346460b690c753024`	affected	< a8abecc638a7feb20b78fabd563b05e30c071331
`577bbf23b758848f0c4a50d346460b690c753024`	affected	< b5184b3f0e9d4cc47059ba1138c9a73d43d2493f
`577bbf23b758848f0c4a50d346460b690c753024`	affected	< 668face37fdb6b6900645dc8777195498541c9a7
`577bbf23b758848f0c4a50d346460b690c753024`	affected	< bbba3e260a62810a717b4442a3bb96d0ec0f6309

Linux

affected

Version	Status	Constraints
`5.4`	affected	—
`0`	unaffected	< 5.4
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[577bbf23b758848f0c4a50d346460b690c753024,4872161e6fbe4e1783daea8bff79caddfae0fb82)`	affected	code_commit	—
`[577bbf23b758848f0c4a50d346460b690c753024,a8abecc638a7feb20b78fabd563b05e30c071331)`	affected	code_commit	—
`[577bbf23b758848f0c4a50d346460b690c753024,b5184b3f0e9d4cc47059ba1138c9a73d43d2493f)`	affected	code_commit	—
`[577bbf23b758848f0c4a50d346460b690c753024,668face37fdb6b6900645dc8777195498541c9a7)`	affected	code_commit	—
`[577bbf23b758848f0c4a50d346460b690c753024,bbba3e260a62810a717b4442a3bb96d0ec0f6309)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.4`	affected	generic	—
`[0,5.4)`	unaffected	semver	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Deploy a kernel update that includes commit 4872161e6fbe4e1783daea8bff79caddfae0fb82 and reboot to load the fixed driver.
If an update is not yet available, unload or disable the sun4i_csi module to prevent buffer leaks during operation.
Monitor kernel memory usage and system stability for signs of abnormal memory consumption or crashes that might indicate lingering buffer leaks.

Generated by OpenCVE AI on August 14, 2026 at 01:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/29fce7bcb3b959f6d4fdcdff7d26330152fdf98d
https://git.kernel.org/stable/c/3c0bd793b0083fd4639ba7f60d1e7db8c8ac459a
https://git.kernel.org/stable/c/4872161e6fbe4e1783daea8bff79caddfae0fb82
https://git.kernel.org/stable/c/668face37fdb6b6900645dc8777195498541c9a7
https://git.kernel.org/stable/c/7c2c30e282745a83d332c3cf92d1c0bcc491ac54
https://git.kernel.org/stable/c/a8abecc638a7feb20b78fabd563b05e30c071331
https://git.kernel.org/stable/c/b5184b3f0e9d4cc47059ba1138c9a73d43d2493f
https://git.kernel.org/stable/c/bbba3e260a62810a717b4442a3bb96d0ec0f6309
https://nvd.nist.gov/vuln/detail/CVE-2026-68209
https://www.cve.org/CVERecord?id=CVE-2026-68209

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/29fce7bcb3b959f6d4fdcdff7d26330152fdf98d https://git.kernel.org/stable/c/3c0bd793b0083fd4639ba7f60d1e7db8c8ac459a https://git.kernel.org/stable/c/7c2c30e282745a83d332c3cf92d1c0bcc491ac54

Thu, 13 Aug 2026 22:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 13 Aug 2026 07:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-399

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68209 https://www.cve.org/CVERecord?id=CVE-2026-68209
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-399

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: media: sun4i-csi: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. sun4i_csi_start_streaming() returned -EINVAL when no matching CSI format could be found, before any setup (scratch buffer allocation, pipeline start) had been performed. The remaining error paths already converge on the err_clear_dma_queue label, which calls return_all_buffers(..., VB2_BUF_STATE_QUEUED) under csi->qlock. Jump to that label directly: the intermediate err_disable_device / err_disable_pipeline / err_free_scratch_buffer labels are skipped, which is correct because nothing they would undo has happened yet. This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").
Title		media: sun4i-csi: Return queued buffers on start_streaming() failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4872161e6fbe4e1783daea8bff79caddfae0fb82 https://git.kernel.org/stable/c/668face37fdb6b6900645dc8777195498541c9a7 https://git.kernel.org/stable/c/a8abecc638a7feb20b78fabd563b05e30c071331 https://git.kernel.org/stable/c/b5184b3f0e9d4cc47059ba1138c9a73d43d2493f https://git.kernel.org/stable/c/bbba3e260a62810a717b4442a3bb96d0ec0f6309

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:00:28.245Z

Updated: 2026-08-19T16:31:31.902Z

Reserved: 2026-07-30T09:28:09.374Z

Link: CVE-2026-68209

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:20:08.637

Modified: 2026-08-19T17:20:36.807

Link: CVE-2026-68209

Redhat

Severity : Moderate

Publid Date: 2026-08-10T12:00:28Z

Links: CVE-2026-68209 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-14T01:30:04Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object