CVE-2026-68216 Overview
CVE-2026-68216 is a Linux kernel vulnerability in the pwc (Philips USB Webcam) media driver. The videobuf2 (vb2) framework passes buffers to the driver via buf_queue() before invoking start_streaming(). When start_streaming() returns an error without releasing those buffers through vb2_buffer_done(), vb2_start_streaming() triggers a WARN_ON(owned_by_drv_count) and the queued buffers leak. Two early return paths in the pwc driver triggered this condition: -ENODEV when the USB device was already disconnected, and -ERESTARTSYS when mutex_lock_interruptible() was interrupted by a signal.
Critical Impact
A local attacker with access to the pwc device node can trigger repeated buffer leaks and kernel warnings, leading to memory exhaustion and denial of service on affected systems.
Affected Products
- Linux kernel pwc media driver (Philips USB Webcam)
- Linux kernel stable branches referenced by commits 5d7cc26, 975b2ee, a4f8f62, cb16b79, and f2f9fca
- Systems exposing /dev/video* nodes backed by the pwc driver
Discovery Timeline
- 2026-08-10 - CVE-2026-68216 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68216
Vulnerability Analysis
The vulnerability originates in the pwc driver's start_streaming() implementation. The vb2 framework contract requires that any buffer handed to the driver via buf_queue() be returned through vb2_buffer_done() before start_streaming() returns an error. The pwc driver failed to honor this contract on two error paths. When the underlying USB device was disconnected, the driver returned -ENODEV directly. When mutex_lock_interruptible() was interrupted by a signal, the driver returned -ERESTARTSYS. In both cases, the queued buffers remained owned by the driver, causing the WARN_ON(owned_by_drv_count) assertion in vb2_start_streaming() to fire and leaking the buffer resources.
Root Cause
The root cause is a resource-management contract violation in the driver. Two of three error exits in start_streaming() skipped the cleanup step that the third exit path (pwc_isoc_init() failure) performed correctly. The fix routes both error paths through the existing pwc_cleanup_queued_bufs() helper with state VB2_BUF_STATE_QUEUED before returning, mirroring the previously-applied uvcvideo fix in commit 4cf3b6fd54eb.
Attack Vector
Exploitation requires local access with permission to open the affected video device. An attacker can repeatedly initiate streaming while inducing the error conditions, for example by sending signals to interrupt mutex_lock_interruptible() or by racing USB disconnect events. Each failed attempt leaks vb2 buffers, exhausting kernel memory and triggering kernel log noise from the WARN_ON. See the kernel commit for the resolution.
Detection Methods for CVE-2026-68216
Indicators of Compromise
- Repeated WARN_ON traces originating from vb2_start_streaming() in dmesg or /var/log/kern.log.
- Unexplained growth in kernel slab allocations tied to videobuf2 buffer objects on hosts with pwc devices attached.
- Elevated rate of signal delivery to processes holding open handles on pwc-backed /dev/video* nodes.
Detection Strategies
- Monitor kernel ring buffer for owned_by_drv_count warnings and stack traces referencing pwc_start_streaming.
- Audit which local users and containers have read/write access to /dev/video* device nodes backed by the pwc driver.
- Track process behavior that repeatedly opens the video device and issues VIDIOC_STREAMON ioctls followed by signal-induced interruption.
Monitoring Recommendations
- Ingest kernel logs into a centralized logging pipeline and alert on WARN_ON events from drivers/media/.
- Baseline memory consumption on multimedia-enabled endpoints and alert on abnormal kernel memory growth.
- Track kernel package versions across the fleet to confirm patched builds are deployed on all hosts using USB video devices.
How to Mitigate CVE-2026-68216
Immediate Actions Required
- Upgrade to a Linux kernel that includes the fix commits 5d7cc26, 975b2ee, a4f8f62, cb16b79, or f2f9fca from the stable trees.
- Restrict access to /dev/video* device nodes to trusted users and services only.
- If the pwc driver is not required, blacklist the module to remove the attack surface entirely.
Patch Information
The fix routes both the -ENODEV and -ERESTARTSYS error paths in the pwc driver's start_streaming() through pwc_cleanup_queued_bufs() with VB2_BUF_STATE_QUEUED before returning. Apply the upstream stable kernel updates referenced by commits 5d7cc26, 975b2ee, a4f8f62, cb16b79, and f2f9fca.
Workarounds
- Unload and blacklist the pwc kernel module on systems that do not require Philips USB webcam support.
- Tighten permissions on /dev/video* nodes using udev rules to limit access to a dedicated video group.
- Restrict USB device attachment on servers and sensitive endpoints via USBGuard or equivalent controls.
# Blacklist the pwc module
echo 'blacklist pwc' | sudo tee /etc/modprobe.d/blacklist-pwc.conf
sudo modprobe -r pwc
# Restrict access to video device nodes via udev
echo 'KERNEL=="video[0-9]*", GROUP="video", MODE="0660"' | \
sudo tee /etc/udev/rules.d/99-video-access.rules
sudo udevadm control --reload-rules && sudo udevadm trigger
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
