CVE-2026-68222: In the Linux kernel, the following vulnerability has been resolved: media: msi2500: Return queued buffers on start_stre
Summary
A vulnerability in the Linux kernel's msi2500 media driver caused buffers (data containers) to leak when the start_streaming() function failed, because the driver didn't properly return those buffers to the vb2 framework (a kernel subsystem that manages video buffers). The problem occurred across five different error scenarios, some of which also incorrectly overwrote error codes, making debugging harder.
Solution / Mitigation
The fix consolidates error handling into a goto chain that ensures every failure path stops the function, drains the queued-buffer list, and returns the correct error code. For the most severe case (when msi2500_ctrl_msg() fails), the fix also rolls back the preceding msi2500_isoc_init() call via msi2500_isoc_cleanup() before unlocking and draining buffers. A cleanup helper was added that accepts a vb2_buffer_state argument, allowing start_streaming error paths to return VB2_BUF_STATE_QUEUED (the correct state for userspace on failure) while stop_streaming maintains its existing VB2_BUF_STATE_ERROR behavior.
Vulnerability Details
EPSS: 0.0%
August 10, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-68222
First tracked: August 10, 2026 at 02:08 PM
Classified by LLM (prompt v3) · confidence: 95%