CVE-2026-68222: media: msi2500: Return queued buffers on start_streaming() failure
In the Linux kernel, the following vulnerability has been resolved:
media: msi2500: Return queued buffers on startstreaming() failure
The vb2 framework hands buffers to the driver via bufqueue() before calling startstreaming(). If startstreaming() returns an error without first returning those buffers via vb2bufferdone(), vb2startstreaming() fires WARNON(ownedbydrvcount) and the queued buffers leak.
msi2500startstreaming() had five error paths that all hit this trap and were further tangled by ret-overwriting between calls:
- -ENODEV when the USB device was already disconnected - -ERESTARTSYS when mutexlockinterruptible() was interrupted - msi2500setusbadc() failure: ret was silently overwritten by the next call (msi2500isocinit), so the error was lost entirely - msi2500isocinit() failure: cleanupqueuedbufs was called, but the function then fell through to msi2500ctrlmsg() and again masked the original error by overwriting ret - msi2500ctrlmsg(CMDSTARTSTREAMING) failure: no cleanup at all, leaving isoc URBs submitted with no way for the driver to consume them
Consolidate the error paths into a small goto chain. Every failure now stops the function, drains the queued-buffer list, and returns the real error code. The ctrlmsg failure path also rolls back the preceding msi2500isocinit() via msi2500isoccleanup() before unlocking and draining.
The cleanup helper takes a vb2bufferstate argument so that the startstreaming error paths can pass VB2BUFSTATEQUEUED (as expected by userspace on startstreaming failure) while stopstreaming keeps its existing VB2BUFSTATEERROR semantics.
This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on startstreaming() failure").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Consolidate the five msi2500_start_streaming() error paths into a small goto chain so that on any failure (including msi2500_ctrl_msg(CMD_START_STREAMING) failure, msi2500_isoc_init() failure, and msi2500_set_usb_adc() ret-overwrite failure), the function stops, drains/unlocks the queued-buffer list, calls msi2500_isoc_cleanup() as needed, rolls back the ctrl_msg failure path, and ensures queued buffers are returned with VB2_BUF_STATE_ERROR semantics on start_streaming() failure.
Linux kernel media driver (msi2500) Error handling / goto cleanup chain for start_streaming() = Implemented
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68222?
CVE-2026-68222 has a risk score of 23, indicating a higher severity vulnerability in the Linux kernel.
How do I fix CVE-2026-68222?
To fix CVE-2026-68222, update your Linux kernel to the latest version where this vulnerability has been patched.
What systems are affected by CVE-2026-68222?
CVE-2026-68222 affects systems utilizing the Linux kernel that implement the msi2500 media driver.
What are the potential impacts of CVE-2026-68222?
The potential impacts of CVE-2026-68222 include the inability to properly handle queued buffers, which could lead to data loss or system instability.
When was CVE-2026-68222 published?
CVE-2026-68222 was published on August 10, 2026.