CVE-2026-68231
Description
In the Linux kernel, the following vulnerability has been resolved: media: airspy: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. airspy_start_streaming() returned -ENODEV early when the USB device had been disconnected (s->udev == NULL) without returning any buffers that buf_queue() had already accepted. Take v4l2_lock first and jump to the existing err_clear_bit label, which already drains s->queued_bufs via vb2_buffer_done(..., VB2_BUF_STATE_QUEUED) before unlocking. This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").
How to fix
- Linux Linuxbadceeb82a9d8d8e98d07859f3c89130ae1998b9, 122ce0c0af629a8765ddf1adf6fb85c6db3d47cb, bcdf261c4c29077fc3da6449f7eda77357046205, 877686a74ecdc93dcaee09dbac566e819059c9e7, cd42623d698b59f1fe5768f78a4101c28d5feb2e, 73bd2779865372b1017d4f555b45270aa2d0d710, 170fcc945bc094b1c956bf555c070692826a3eff, 04344d0b4929caa94c0df72f767752aa0935ef5d or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 634fe5033951b80ef4b98d8f047cb1083d29170d ≤ v < badceeb82a9d8d8e98d07859f3c89130ae1998b9, 634fe5033951b80ef4b98d8f047cb1083d29170d ≤ v < 122ce0c0af629a8765ddf1adf6fb85c6db3d47cb, 634fe5033951b80ef4b98d8f047cb1083d29170d ≤ v < bcdf261c4c29077fc3da6449f7eda77357046205, 634fe5033951b80ef4b98d8f047cb1083d29170d ≤ v < 877686a74ecdc93dcaee09dbac566e819059c9e7, 634fe5033951b80ef4b98d8f047cb1083d29170d ≤ v < cd42623d698b59f1fe5768f78a4101c28d5feb2e, 634fe5033951b80ef4b98d8f047cb1083d29170d ≤ v < 73bd2779865372b1017d4f555b45270aa2d0d710, 634fe5033951b80ef4b98d8f047cb1083d29170d ≤ v < 170fcc945bc094b1c956bf555c070692826a3eff, 634fe5033951b80ef4b98d8f047cb1083d29170d ≤ v < 04344d0b4929caa94c0df72f767752aa0935ef5d, 3.17 | badceeb82a9d8d8e98d07859f3c89130ae1998b9, 122ce0c0af629a8765ddf1adf6fb85c6db3d47cb, bcdf261c4c29077fc3da6449f7eda77357046205, 877686a74ecdc93dcaee09dbac566e819059c9e7, cd42623d698b59f1fe5768f78a4101c28d5feb2e, 73bd2779865372b1017d4f555b45270aa2d0d710, 170fcc945bc094b1c956bf555c070692826a3eff, 04344d0b4929caa94c0df72f767752aa0935ef5d |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.