CVE-2026-68231: media: airspy: Return queued buffers on start_streaming() failure
In the Linux kernel, the following vulnerability has been resolved:
media: airspy: Return queued buffers on startstreaming() failure
The vb2 framework hands buffers to the driver via bufqueue() before calling startstreaming(). If startstreaming() returns an error without first returning those buffers via vb2bufferdone(), vb2startstreaming() fires WARNON(ownedbydrvcount) and the queued buffers leak.
airspystartstreaming() returned -ENODEV early when the USB device had been disconnected (s->udev == NULL) without returning any buffers that bufqueue() had already accepted. Take v4l2lock first and jump to the existing errclearbit label, which already drains s->queuedbufs via vb2bufferdone(..., VB2BUFSTATEQUEUED) before unlocking.
This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on startstreaming() failure").
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68231?
The severity of CVE-2026-68231 is rated at 9, indicating a high risk level.
How do I fix CVE-2026-68231?
To fix CVE-2026-68231, ensure that you update to the latest version of the Linux kernel where this vulnerability has been resolved.
What does CVE-2026-68231 affect?
CVE-2026-68231 affects the media subsystem of the Linux kernel specifically related to the airspy driver.
When was CVE-2026-68231 published?
CVE-2026-68231 was published on August 10, 2026.
What are the implications of CVE-2026-68231?
CVE-2026-68231 could potentially lead to a loss of queued buffers if the start_streaming() function fails without handling them properly.