Skip to main content

Linux Kernel EUVDEUVD-2026-55310

| CVE-2026-68209 HIGH
2026-08-10 Linux GHSA-93x6-mg2w-rrg6
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.1 MEDIUM

Local low-privilege access to /dev/video* required; primary impact is memory exhaustion (A:H); leaked DMA buffers may expose image frame data (C:L); no integrity impact from error-path leak.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 01:36 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:00 cve.org
HIGH 7.8
CVE Published
Aug 10, 2026 - 12:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

media: sun4i-csi: Return queued buffers on start_streaming() failure

The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak.

sun4i_csi_start_streaming() returned -EINVAL when no matching CSI format could be found, before any setup (scratch buffer allocation, pipeline start) had been performed. The remaining error paths already converge on the err_clear_dma_queue label, which calls return_all_buffers(..., VB2_BUF_STATE_QUEUED) under csi->qlock. Jump to that label directly: the intermediate err_disable_device / err_disable_pipeline / err_free_scratch_buffer labels are skipped, which is correct because nothing they would undo has happened yet.

This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").

AnalysisAI

Buffer leak in the Linux kernel's sun4i-csi camera driver (Allwinner SoC Camera Sensor Interface) allows a local attacker with low-privilege access to the V4L2 camera interface to exhaust kernel memory by repeatedly triggering start_streaming() failure with an unsupported CSI format. The vb2 framework hands buffers to the driver before calling start_streaming(); when that call returns -EINVAL on the early format-validation path, those buffers are never returned via vb2_buffer_done(), leaking kernel memory and triggering WARN_ON(owned_by_drv_count). No public exploit exists and EPSS stands at 0.21% (11th percentile), indicating negligible real-world exploitation interest; the NVD-assigned C:H/I:H/A:H impact appears overstated relative to the actual error-path memory leak primitive.

Technical ContextAI

The sun4i-csi driver supports the Camera Sensor Interface found on Allwinner ARM SoCs (A10, A20, etc.), commonly used in single-board computers such as Orange Pi. It interfaces with the Video Buffer 2 (vb2) kernel framework, which manages DMA video capture buffers. The vb2 contract requires that every buffer handed to a driver via buf_queue() be returned via vb2_buffer_done() before or during any error handling in start_streaming(). The defective code path in sun4i_csi_start_streaming() returned -EINVAL immediately when no matching CSI format was found, bypassing the err_clear_dma_queue error label (which called return_all_buffers(..., VB2_BUF_STATE_QUEUED) under csi->qlock). The fix redirects this early-exit path to err_clear_dma_queue directly, mirroring the identical pattern fixed in uvcvideo (commit 4cf3b6fd54eb). No CWE is formally assigned; the closest classification is CWE-401 (Missing Release of Memory after Effective Lifetime) or CWE-404 (Improper Resource Shutdown or Release). Affected products per EUVD CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, introduced at commit 577bbf23b758848f0c4a50d346460b690c753024.

RemediationAI

Upstream fix available via kernel stable commits; released patched versions confirmed per EUVD as Linux 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc1. Administrators should apply the appropriate stable-tree update for their running kernel series; distribution vendors (Debian, Ubuntu, Fedora, Armbian, etc.) targeting Allwinner SoC platforms should issue updated kernel packages incorporating the relevant commit. If immediate patching is not possible, a compensating control is to restrict access to the V4L2 camera device node (/dev/video*) using udev rules or filesystem permissions (e.g., removing group ownership from the 'video' group for unprivileged users), preventing low-privilege local users from triggering start_streaming(). This trade-off is that legitimate camera-using applications will require elevated privileges or explicit device ACLs. Unloading the sun4i-csi kernel module (modprobe -r sun4i-csi) eliminates the attack surface entirely on systems where camera capture is not required, at the cost of losing camera functionality.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-55310 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy