CVE-2026-68222 - Vulnerability Details

- media: msi2500: Return queued buffers on start_streaming() failure

Description

In the Linux kernel, the following vulnerability has been resolved:

media: msi2500: Return queued buffers on start_streaming() failure

The vb2 framework hands buffers to the driver via buf_queue() before
calling start_streaming(). If start_streaming() returns an error
without first returning those buffers via vb2_buffer_done(),
vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued
buffers leak.

msi2500_start_streaming() had five error paths that all hit this trap
and were further tangled by ret-overwriting between calls:

- -ENODEV when the USB device was already disconnected
- -ERESTARTSYS when mutex_lock_interruptible() was interrupted
- msi2500_set_usb_adc() failure: ret was silently overwritten by
the next call (msi2500_isoc_init), so the error was lost entirely
- msi2500_isoc_init() failure: cleanup_queued_bufs was called, but
the function then fell through to msi2500_ctrl_msg() and again
masked the original error by overwriting ret
- msi2500_ctrl_msg(CMD_START_STREAMING) failure: no cleanup at all,
leaving isoc URBs submitted with no way for the driver to consume
them

Consolidate the error paths into a small goto chain. Every failure
now stops the function, drains the queued-buffer list, and returns
the real error code. The ctrl_msg failure path also rolls back the
preceding msi2500_isoc_init() via msi2500_isoc_cleanup() before
unlocking and draining.

The cleanup helper takes a vb2_buffer_state argument so that the
start_streaming error paths can pass VB2_BUF_STATE_QUEUED (as
expected by userspace on start_streaming failure) while stop_streaming
keeps its existing VB2_BUF_STATE_ERROR semantics.

This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo:
Return queued buffers on start_streaming() failure").

Published: 2026-08-10

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The issue occurs in the Linux kernel media subsystem when the msi2500 driver fails to properly release queued buffers during start_streaming() error paths. Several branches swallow the original error code and do not call vb2_buffer_done(), causing queued buffers remain allocated. This triggers WARN_ON in vb2_start_streaming() and results in a persistent leak of kernel buffers, a classic CWE-772 (Uncontrolled Resource Consumption) scenario that can exhaust memory or destabilize the system.

Affected Systems

All systems running the Linux kernel that include the msi2500 v4l2 driver are affected, regardless of vendor or distribution. The vulnerability is present in any kernel version that has not applied the patch that consolidates error handling for start_streaming. No specific vendor versions are listed, but any installation of this driver on Linux is potentially impacted.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. The EPSS score of <1% suggests a low probability of exploitation. The flaw can be exploited by an attacker who can interact with the msi2500 device to trigger the failure paths. The likely attack vector is local device interaction with the driver; no privilege escalation is required beyond the ability to interface with the driver. Once exploited, the driver leaks buffers, potentially leading to resource exhaustion and denial of service. The vulnerability is not listed in CISA’s KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`977e444f59ad16eedf66acae4f357011c74da291`	affected	< c74b680704baecea4620c0774de473069e0bc4e8
`977e444f59ad16eedf66acae4f357011c74da291`	affected	< 2d10eedb786a13f91d76e11320fabb0bf712519f
`977e444f59ad16eedf66acae4f357011c74da291`	affected	< 2de14ddb4fea04ca616403a6ba81c5e8099e9b9e
`977e444f59ad16eedf66acae4f357011c74da291`	affected	< 1d58229b330b7f67fbfa07e0f2a8a51fbeafaa9a
`977e444f59ad16eedf66acae4f357011c74da291`	affected	< bab9d5a67d4db96ae8c187b92b37979911302a10
`977e444f59ad16eedf66acae4f357011c74da291`	affected	< 264b5380c4f8aa92dbc2983ecd2b627f1d5e0061
`977e444f59ad16eedf66acae4f357011c74da291`	affected	< 3673cb0a5711e910074d69201da9e1535c03f97a
`977e444f59ad16eedf66acae4f357011c74da291`	affected	< 7201c17786a498497bca57752883b90914d405ac

Linux

affected

Version	Status	Constraints
`3.12`	affected	—
`0`	unaffected	< 3.12
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[977e444f59ad16eedf66acae4f357011c74da291,1d58229b330b7f67fbfa07e0f2a8a51fbeafaa9a)`	affected	code_commit	—
`[977e444f59ad16eedf66acae4f357011c74da291,bab9d5a67d4db96ae8c187b92b37979911302a10)`	affected	code_commit	—
`[977e444f59ad16eedf66acae4f357011c74da291,264b5380c4f8aa92dbc2983ecd2b627f1d5e0061)`	affected	code_commit	—
`[977e444f59ad16eedf66acae4f357011c74da291,3673cb0a5711e910074d69201da9e1535c03f97a)`	affected	code_commit	—
`[977e444f59ad16eedf66acae4f357011c74da291,7201c17786a498497bca57752883b90914d405ac)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.12`	affected	semver	—
`[0,3.12)`	unaffected	semver	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a release that contains the patch that consolidates msi2500 start_streaming error handling, such as kernel versions that include the commit identified by 1d58229b.
If updating the kernel is not immediately possible, disable msi2500 streaming functionality or disconnect the device until the patch is applied to prevent the buffer leak from occurring.
For environments where upgrading the distribution kernel is delayed, manually apply the specific upstream patch (commit 1d58229b) to the kernel source and rebuild, or build a custom kernel that incorporates the fix.

Generated by OpenCVE AI on August 14, 2026 at 00:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00138.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1d58229b330b7f67fbfa07e0f2a8a51fbeafaa9a
https://git.kernel.org/stable/c/264b5380c4f8aa92dbc2983ecd2b627f1d5e0061
https://git.kernel.org/stable/c/2d10eedb786a13f91d76e11320fabb0bf712519f
https://git.kernel.org/stable/c/2de14ddb4fea04ca616403a6ba81c5e8099e9b9e
https://git.kernel.org/stable/c/3673cb0a5711e910074d69201da9e1535c03f97a
https://git.kernel.org/stable/c/7201c17786a498497bca57752883b90914d405ac
https://git.kernel.org/stable/c/bab9d5a67d4db96ae8c187b92b37979911302a10
https://git.kernel.org/stable/c/c74b680704baecea4620c0774de473069e0bc4e8
https://nvd.nist.gov/vuln/detail/CVE-2026-68222
https://www.cve.org/CVERecord?id=CVE-2026-68222

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2d10eedb786a13f91d76e11320fabb0bf712519f https://git.kernel.org/stable/c/2de14ddb4fea04ca616403a6ba81c5e8099e9b9e https://git.kernel.org/stable/c/c74b680704baecea4620c0774de473069e0bc4e8

Thu, 13 Aug 2026 22:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 13 Aug 2026 06:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-795

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68222 https://www.cve.org/CVERecord?id=CVE-2026-68222
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 18:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-795

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: media: msi2500: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. msi2500_start_streaming() had five error paths that all hit this trap and were further tangled by ret-overwriting between calls: - -ENODEV when the USB device was already disconnected - -ERESTARTSYS when mutex_lock_interruptible() was interrupted - msi2500_set_usb_adc() failure: ret was silently overwritten by the next call (msi2500_isoc_init), so the error was lost entirely - msi2500_isoc_init() failure: cleanup_queued_bufs was called, but the function then fell through to msi2500_ctrl_msg() and again masked the original error by overwriting ret - msi2500_ctrl_msg(CMD_START_STREAMING) failure: no cleanup at all, leaving isoc URBs submitted with no way for the driver to consume them Consolidate the error paths into a small goto chain. Every failure now stops the function, drains the queued-buffer list, and returns the real error code. The ctrl_msg failure path also rolls back the preceding msi2500_isoc_init() via msi2500_isoc_cleanup() before unlocking and draining. The cleanup helper takes a vb2_buffer_state argument so that the start_streaming error paths can pass VB2_BUF_STATE_QUEUED (as expected by userspace on start_streaming failure) while stop_streaming keeps its existing VB2_BUF_STATE_ERROR semantics. This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").
Title		media: msi2500: Return queued buffers on start_streaming() failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1d58229b330b7f67fbfa07e0f2a8a51fbeafaa9a https://git.kernel.org/stable/c/264b5380c4f8aa92dbc2983ecd2b627f1d5e0061 https://git.kernel.org/stable/c/3673cb0a5711e910074d69201da9e1535c03f97a https://git.kernel.org/stable/c/7201c17786a498497bca57752883b90914d405ac https://git.kernel.org/stable/c/bab9d5a67d4db96ae8c187b92b37979911302a10

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:00:42.687Z

Updated: 2026-08-19T16:31:51.745Z

Reserved: 2026-07-30T09:28:09.375Z

Link: CVE-2026-68222

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:20:10.270

Modified: 2026-08-19T17:20:38.120

Link: CVE-2026-68222

Redhat

Severity : Moderate

Publid Date: 2026-08-10T12:00:42Z

Links: CVE-2026-68222 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-14T00:30:03Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object