CVE-2026-68231

In the Linux kernel, the following vulnerability has been resolved: media: airspy: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. airspy_start_streaming() returned -ENODEV early when the USB device had been disconnected (s->udev == NULL) without returning any buffers that buf_queue() had already accepted. Take v4l2_lock first and jump to the existing err_clear_bit label, which already drains s->queued_bufs via vb2_buffer_done(..., VB2_BUF_STATE_QUEUED) before unlocking. This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/04344d0b4929caa94c0df72f767752aa0935ef5d
https://git.kernel.org/stable/c/122ce0c0af629a8765ddf1adf6fb85c6db3d47cb
https://git.kernel.org/stable/c/170fcc945bc094b1c956bf555c070692826a3eff
https://git.kernel.org/stable/c/73bd2779865372b1017d4f555b45270aa2d0d710
https://git.kernel.org/stable/c/877686a74ecdc93dcaee09dbac566e819059c9e7
https://git.kernel.org/stable/c/badceeb82a9d8d8e98d07859f3c89130ae1998b9
https://git.kernel.org/stable/c/bcdf261c4c29077fc3da6449f7eda77357046205
https://git.kernel.org/stable/c/cd42623d698b59f1fe5768f78a4101c28d5feb2e

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-10 13:20

Updated : 2026-08-19 17:20

NVD link : CVE-2026-68231

Mitre link : CVE-2026-68231

CVE.ORG link : CVE-2026-68231

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-68231", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "634fe5033951b80ef4b98d8f047cb1083d29170d", "lessThan": "badceeb82a9d8d8e98d07859f3c89130ae1998b9", "versionType": "git"}, {"status": "affected", "version": "634fe5033951b80ef4b98d8f047cb1083d29170d", "lessThan": "122ce0c0af629a8765ddf1adf6fb85c6db3d47cb", "versionType": "git"}, {"status": "affected", "version": "634fe5033951b80ef4b98d8f047cb1083d29170d", "lessThan": "bcdf261c4c29077fc3da6449f7eda77357046205", "versionType": "git"}, {"status": "affected", "version": "634fe5033951b80ef4b98d8f047cb1083d29170d", "lessThan": "877686a74ecdc93dcaee09dbac566e819059c9e7", "versionType": "git"}, {"status": "affected", "version": "634fe5033951b80ef4b98d8f047cb1083d29170d", "lessThan": "cd42623d698b59f1fe5768f78a4101c28d5feb2e", "versionType": "git"}, {"status": "affected", "version": "634fe5033951b80ef4b98d8f047cb1083d29170d", "lessThan": "73bd2779865372b1017d4f555b45270aa2d0d710", "versionType": "git"}, {"status": "affected", "version": "634fe5033951b80ef4b98d8f047cb1083d29170d", "lessThan": "170fcc945bc094b1c956bf555c070692826a3eff", "versionType": "git"}, {"status": "affected", "version": "634fe5033951b80ef4b98d8f047cb1083d29170d", "lessThan": "04344d0b4929caa94c0df72f767752aa0935ef5d", "versionType": "git"}], "programFiles": ["drivers/media/usb/airspy/airspy.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.17"}, {"status": "unaffected", "version": "0", "lessThan": "3.17", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.148", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.101", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/media/usb/airspy/airspy.c"], "defaultStatus": "affected"}]}], "published": "2026-08-10T13:20:11.370", "references": [{"url": "https://git.kernel.org/stable/c/04344d0b4929caa94c0df72f767752aa0935ef5d", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/122ce0c0af629a8765ddf1adf6fb85c6db3d47cb", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/170fcc945bc094b1c956bf555c070692826a3eff", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/73bd2779865372b1017d4f555b45270aa2d0d710", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/877686a74ecdc93dcaee09dbac566e819059c9e7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/badceeb82a9d8d8e98d07859f3c89130ae1998b9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bcdf261c4c29077fc3da6449f7eda77357046205", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/cd42623d698b59f1fe5768f78a4101c28d5feb2e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: airspy: Return queued buffers on start_streaming() failure\n\nThe vb2 framework hands buffers to the driver via buf_queue() before\ncalling start_streaming(). If start_streaming() returns an error\nwithout first returning those buffers via vb2_buffer_done(),\nvb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued\nbuffers leak.\n\nairspy_start_streaming() returned -ENODEV early when the USB device had\nbeen disconnected (s->udev == NULL) without returning any buffers that\nbuf_queue() had already accepted. Take v4l2_lock first and jump to the\nexisting err_clear_bit label, which already drains s->queued_bufs via\nvb2_buffer_done(..., VB2_BUF_STATE_QUEUED) before unlocking.\n\nThis mirrors the uvcvideo fix in commit 4cf3b6fd54eb (\"media: uvcvideo:\nReturn queued buffers on start_streaming() failure\")."}], "lastModified": "2026-08-19T17:20:38.803", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}