CVE-2026-68204

This CVE patches a missing vb2_is_busy() guard in the vivid driver's format update functions (vivid_update_format_cap and vivid_update_format_out). The vulnerability allows format changes during a timing window between REQBUFS allocating buffers and STREAMON beginning streaming — a state where buffers exist but aren't yet considered "busy" by the vb2 framework. The practical impact: an attacker with userspace access can trigger format mutations while the driver believes no operations are in-flight, potentially causing the 'unexpected results' the commit message references. The lack of a deterministic reproducer is significant — this indicates the vulnerable code path requires a specific sequence of buffer lifecycle states that only fuzzing exhaustively exercises. The fix adds both the missing guards and WARN_ON assertions. The WARN_ON is telling: it documents an invariant the developers realized existed but never formally specified. This is a diagnostic hedge — if the guard fails to prevent the race, the assertion at least logs it. For defenders: verify your media pipeline drivers implement consistent vb2_is_busy() guards across ALL control paths that mutate format or resolution. The REQBUFS-to-STREAMON window is where this class of bug manifests. If you're maintaining vb2-based drivers, audit format change paths specifically — not just streaming operations. The WARN_ON may generate noise in production if this window is reachable through unexpected sequences; treat such logs as investigation triggers rather than isolated incidents. The deeper question: this window may have existed for years in production kernels with no way to detect exploitation. The absence of reproducers doesn't mean the window wasn't reachable — only that the specific timing requirements weren't characterized.

Reviewed through automated stages and approved by a human before publication.