CVE-2026-68231media: airspy: Return queued buffers on start_streaming() failure
- —Not scoredno CVSS score yet
- 0.22%Exploitation in 30 daysEPSS · top 87% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: media: airspy: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. airspy_start_streaming() returned -ENODEV early when the USB device had been disconnected (s->udev == NULL) without returning any buffers that buf_queue() had already accepted. Take v4l2_lock first and jump to the existing err_clear_bit label, which already drains s->queued_bufs via vb2_buffer_done(..., VB2_BUF_STATE_QUEUED) before unlocking. This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").
Timeline
ID reserved
By Linux
- 11 days later
· 11 days later
Published
- 9 days later
· 9 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.22% · top 87% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 634fe5033951b80ef4b98d8f047cb1083d29170d – < badceeb82a9d8d8e98d07859f3c89130ae1998b9
- affected 634fe5033951b80ef4b98d8f047cb1083d29170d – < 122ce0c0af629a8765ddf1adf6fb85c6db3d47cb
- affected 634fe5033951b80ef4b98d8f047cb1083d29170d – < bcdf261c4c29077fc3da6449f7eda77357046205
- affected 634fe5033951b80ef4b98d8f047cb1083d29170d – < 877686a74ecdc93dcaee09dbac566e819059c9e7
- affected 634fe5033951b80ef4b98d8f047cb1083d29170d – < cd42623d698b59f1fe5768f78a4101c28d5feb2e
- affected 634fe5033951b80ef4b98d8f047cb1083d29170d – < 73bd2779865372b1017d4f555b45270aa2d0d710
- affected 634fe5033951b80ef4b98d8f047cb1083d29170d – < 170fcc945bc094b1c956bf555c070692826a3eff
- affected 634fe5033951b80ef4b98d8f047cb1083d29170d – < 04344d0b4929caa94c0df72f767752aa0935ef5d
- affected 3.17
- unaffected < 3.17
- unaffected 5.10.265 – ≤ 5.10.*
- unaffected 5.15.216 – ≤ 5.15.*
- unaffected 6.1.183 – ≤ 6.1.*
- unaffected 6.6.148 – ≤ 6.6.*
- unaffected 6.12.101 – ≤ 6.12.*
- unaffected 6.18.42 – ≤ 6.18.*
- unaffected 7.1.6 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/badceeb82a9d8d8e98d07859f3c89130ae1998b9 (opens in a new tab)
- https://git.kernel.org/stable/c/122ce0c0af629a8765ddf1adf6fb85c6db3d47cb (opens in a new tab)
- https://git.kernel.org/stable/c/bcdf261c4c29077fc3da6449f7eda77357046205 (opens in a new tab)
- https://git.kernel.org/stable/c/877686a74ecdc93dcaee09dbac566e819059c9e7 (opens in a new tab)
- https://git.kernel.org/stable/c/cd42623d698b59f1fe5768f78a4101c28d5feb2e (opens in a new tab)
- https://git.kernel.org/stable/c/73bd2779865372b1017d4f555b45270aa2d0d710 (opens in a new tab)
- https://git.kernel.org/stable/c/170fcc945bc094b1c956bf555c070692826a3eff (opens in a new tab)
- https://git.kernel.org/stable/c/04344d0b4929caa94c0df72f767752aa0935ef5d (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-55332 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-68231)Record last updated .