CVE-2026-68211 - Vulnerability Details

- media: stm32-dcmipp: Return queued buffers on start_streaming() failure

Description

In the Linux kernel, the following vulnerability has been resolved:

media: stm32-dcmipp: Return queued buffers on start_streaming() failure

The vb2 framework hands buffers to the driver via buf_queue() before
calling start_streaming(). If start_streaming() returns an error
without first returning those buffers via vb2_buffer_done(),
vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued
buffers leak.

dcmipp_bytecap_start_streaming() returned -EINVAL when the source
subdevice could not be resolved from the media graph, before
pm_runtime_resume_and_get() and media_pipeline_start() had been called.
The remaining error paths already converge on the err_buffer_done
label, which calls dcmipp_bytecap_all_buffers_done(...,
VB2_BUF_STATE_QUEUED). Jump to that label directly: the intermediate
err_pm_put / err_media_pipeline_stop labels are skipped, which is
correct because nothing they would undo has happened yet.

This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo:
Return queued buffers on start_streaming() failure").

Published: 2026-08-10

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The stm32-dcmipp media driver fails to return queued buffers when its start_streaming() routine does not succeed. As a result, the vb2 framework continues to hold references to the buffers, causing a memory and resource leak. Repeated failures can exhaust available memory or buffer credits, negatively affecting system stability or leading to a denial of service.

Affected Systems

This issue exists in the Linux kernel media subsystem driver for STM32 DCMIPP. Any kernel configuration that contains the unpatched driver is potentially affected, as no specific version range is provided. The patch is linked to commit 624af2d4 in the kernel source.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score is below 1%, showing that attacks are expected to be rare, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely local or requires privileged access to a media device file, where an attacker can deliberately provoke start_streaming() failure. The resultant resource exhaustion could degrade or interrupt affected systems, although broader impact beyond the local host is unlikely.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`28e0f37722965fa150af31d82101c95fd21aef60`	affected	< ed342a86bb2f9c1b44a0fc4f6b08c14073946e4f
`28e0f37722965fa150af31d82101c95fd21aef60`	affected	< 624af2d4b5e9d3dd366538e4fb4a2a037792a7e3
`28e0f37722965fa150af31d82101c95fd21aef60`	affected	< ffc8eec06378a340d708c889184ab3e14b57d540

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[28e0f37722965fa150af31d82101c95fd21aef60,ed342a86bb2f9c1b44a0fc4f6b08c14073946e4f)`	affected	code_commit	—
`[28e0f37722965fa150af31d82101c95fd21aef60,624af2d4b5e9d3dd366538e4fb4a2a037792a7e3)`	affected	code_commit	—
`[28e0f37722965fa150af31d82101c95fd21aef60,ffc8eec06378a340d708c889184ab3e14b57d540)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.8`	affected	generic	—
`[0,6.8)`	unaffected	generic	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel version that incorporates the stm32-dcmipp patch (commit 624af2d4).
Reboot the system to load the updated kernel and driver.
Restrict user or application access to the stm32-dcmipp device file (e.g., modify udev rules or file permissions) to reduce the likelihood of triggering the failure path.

Generated by OpenCVE AI on August 13, 2026 at 07:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/624af2d4b5e9d3dd366538e4fb4a2a037792a7e3
https://git.kernel.org/stable/c/ed342a86bb2f9c1b44a0fc4f6b08c14073946e4f
https://git.kernel.org/stable/c/ffc8eec06378a340d708c889184ab3e14b57d540
https://nvd.nist.gov/vuln/detail/CVE-2026-68211
https://www.cve.org/CVERecord?id=CVE-2026-68211

History

Thu, 13 Aug 2026 06:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-401

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68211 https://www.cve.org/CVERecord?id=CVE-2026-68211
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: media: stm32-dcmipp: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. dcmipp_bytecap_start_streaming() returned -EINVAL when the source subdevice could not be resolved from the media graph, before pm_runtime_resume_and_get() and media_pipeline_start() had been called. The remaining error paths already converge on the err_buffer_done label, which calls dcmipp_bytecap_all_buffers_done(..., VB2_BUF_STATE_QUEUED). Jump to that label directly: the intermediate err_pm_put / err_media_pipeline_stop labels are skipped, which is correct because nothing they would undo has happened yet. This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").
Title		media: stm32-dcmipp: Return queued buffers on start_streaming() failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/624af2d4b5e9d3dd366538e4fb4a2a037792a7e3 https://git.kernel.org/stable/c/ed342a86bb2f9c1b44a0fc4f6b08c14073946e4f https://git.kernel.org/stable/c/ffc8eec06378a340d708c889184ab3e14b57d540

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:00:30.502Z

Updated: 2026-08-17T05:00:55.902Z

Reserved: 2026-07-30T09:28:09.375Z

Link: CVE-2026-68211

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:20:08.887

Modified: 2026-08-17T05:18:23.200

Link: CVE-2026-68211

Redhat

Severity : Moderate

Publid Date: 2026-08-10T12:00:30Z

Links: CVE-2026-68211 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T07:45:17Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object