CVE-2026-68209: media: sun4i-csi: Return queued buffers on start_streaming() failure
In the Linux kernel, the following vulnerability has been resolved:
media: sun4i-csi: Return queued buffers on startstreaming() failure
The vb2 framework hands buffers to the driver via bufqueue() before calling startstreaming(). If startstreaming() returns an error without first returning those buffers via vb2bufferdone(), vb2startstreaming() fires WARNON(ownedbydrvcount) and the queued buffers leak.
sun4icsistartstreaming() returned -EINVAL when no matching CSI format could be found, before any setup (scratch buffer allocation, pipeline start) had been performed. The remaining error paths already converge on the errcleardmaqueue label, which calls returnallbuffers(..., VB2BUFSTATEQUEUED) under csi->qlock. Jump to that label directly: the intermediate errdisabledevice / errdisablepipeline / errfreescratchbuffer labels are skipped, which is correct because nothing they would undo has happened yet.
This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on startstreaming() failure").
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68209?
The severity of CVE-2026-68209 is rated at 11, indicating a critical risk to affected systems.
How do I fix CVE-2026-68209?
To fix CVE-2026-68209, users should update their Linux kernel to the latest version where the vulnerability has been patched.
What are the impacts of CVE-2026-68209?
The impact of CVE-2026-68209 includes potential buffer mismanagement leading to DoS attacks or unintended data exposure.
Which systems are affected by CVE-2026-68209?
CVE-2026-68209 affects systems running vulnerable versions of the Linux kernel that utilize the sun4i-csi media driver.
Is CVE-2026-68209 publicly known?
Yes, CVE-2026-68209 is a publicly disclosed vulnerability as of its publication date on August 10, 2026.