Skip to main content

Linux Kernel CVE-2026-68216

| EUVDEUVD-2026-55317 HIGH
2026-08-10 Linux GHSA-3p7c-r2j9-9rqv
Information Disclosure Linux
High
Disputed · 7.8 Vendor: Linux
Share

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local low-privilege access needed to open V4L2 device; no complexity or user interaction beyond webcam presence; kernel-level buffer leak enables full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 03:34 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:00 cve.org
HIGH 7.8
CVE Published
Aug 10, 2026 - 12:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: pwc: Return queued buffers on start_streaming() failure

The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak.

pwc's start_streaming() had two early returns that hit this trap: -ENODEV when the USB device was already disconnected, and -ERESTARTSYS when mutex_lock_interruptible() was interrupted by a signal. Call the existing pwc_cleanup_queued_bufs() helper with VB2_BUF_STATE_QUEUED before returning (matching the state already used by the pwc_isoc_init() error path in the same function).

This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").

AnalysisAI

Buffer leakage in the Linux kernel's pwc (Philips WebCam) driver allows a local low-privileged user to corrupt kernel memory state when start_streaming() fails along two specific error paths: USB device disconnection (-ENODEV) and signal-interrupted mutex acquisition (-ERESTARTSYS). The vb2 videobuf2 framework transfers buffer ownership to the driver before invoking start_streaming(), but the pwc driver's error paths failed to return those buffers via vb2_buffer_done(), triggering WARN_ON(owned_by_drv_count) and leaving kernel buffers in an unreturned, leaked state. No public exploit or CISA KEV entry exists; EPSS is 0.21% (11th percentile), reflecting minimal active exploitation interest, though the CVSS C:H/I:H/A:H scoring reflects the potential severity of kernel-level memory corruption.

Technical ContextAI

The pwc driver (drivers/media/usb/pwc/) supports Philips and Creative USB webcams using the V4L2 (Video4Linux2) media framework's videobuf2 (vb2) buffer management subsystem. The vb2 lifecycle for streaming requires that a driver receiving buffers via buf_queue() must return all owned buffers through vb2_buffer_done() before returning any error from start_streaming(). The pwc driver violated this contract at two early-return sites: returning -ENODEV when the USB device had already been disconnected, and returning -ERESTARTSYS when mutex_lock_interruptible() was interrupted by a POSIX signal. These paths bypassed the existing pwc_cleanup_queued_bufs() helper already used by the pwc_isoc_init() error path. The fix mirrors the analogous uvcvideo correction in commit 4cf3b6fd54eb. Although CWE is not assigned by NVD, this is functionally a resource management failure (analogous to CWE-772: Missing Release of Resource after Effective Lifetime) within kernel space. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, from the introducing commit ceede9fa8939e40ad0ddb4ad1355f45c6f1d3478 onward.

RemediationAI

Upgrade to a patched Linux kernel stable release: 6.6.148, 6.12.101, 6.18.42, 7.1.6, or later. Distribution-packaged kernels from major Linux vendors should be monitored for backported fixes. Upstream stable commits are available directly at https://git.kernel.org/stable/c/f2f9fcacd81953dde6cb86312ab13ca13e689664 and the four associated stable-tree commits. On systems where immediate patching is not feasible, blacklisting the pwc kernel module eliminates the attack surface entirely: add 'blacklist pwc' to /etc/modprobe.d/blacklist.conf and run 'modprobe -r pwc'. The trade-off is complete loss of Philips and Creative USB webcam functionality. On servers, embedded systems, or kiosks without webcam requirements, this trade-off is negligible. No other documented workaround addresses the root cause without disabling the driver.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-68216 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy