CVE-2026-68216

CVE-2026-68216 in the Linux pwc driver exposes a contract violation that runs deeper than a single missing cleanup call. The vb2 framework requires that when start_streaming() fails, drivers must explicitly return all queued buffers via vb2_buffer_done() before propagating the error. The pwc driver violated this in two early-return paths, causing buffers to enter a leaked limbo state—owned by neither vb2 nor the driver. The practical impact isn't theoretical: applications experience silent buffer loss, stream hangs under sustained use, and confusing failures during device hot-unplug or signal interruption. What makes this CVE significant is the explicit precedent in uvcvideo. The same violation pattern, the same fix template, two independent drivers in the same subsystem. This strongly suggests a systemic knowledge gap: driver authors are implementing start_streaming() without fully internalizing the vb2 buffer lifecycle contract. The real question is which other media drivers remain unexamined. The CVSS 7.8 rating reflects local availability impact but underweights the architectural dimension. A single buffer leak is moderate; a class of such leaks across multiple actively-used drivers represents a design-level concern. The -ERESTARTSYS path deserves specific attention—the signal-interrupted code path can be triggered by any process that can open the device and receive signals during capture, potentially accumulating leaked buffer state under repeated interruption. Treat this CVE as closed on pwc, but treat it as an opening audit trigger for the broader media subsystem. Scan other media drivers for the same start_streaming() error-path pattern. The fix template is established; the question is whether the class has been cleared.

Reviewed through automated stages and approved by a human before publication.