CVE-2026-68231: Linux Kernel Airspy Buffer Vulnerability

CVE-2026-68231 Overview

CVE-2026-68231 is a Linux kernel vulnerability in the airspy media driver. The flaw resides in airspy_start_streaming(), which returned -ENODEV early when the USB device was disconnected without releasing buffers that buf_queue() had already accepted from the videobuf2 (vb2) framework. This condition triggers a WARN_ON(owned_by_drv_count) inside vb2_start_streaming() and leaks the queued buffers. The fix mirrors an earlier uvcvideo correction and ensures the driver takes v4l2_lock first, then jumps to the err_clear_bit label that drains s->queued_bufs via vb2_buffer_done(..., VB2_BUF_STATE_QUEUED).

Critical Impact
Local users with access to an airspy USB device can trigger a kernel warning and memory leak by disconnecting the device before streaming begins, degrading system stability over time.

Affected Products

Linux kernel airspy Software Defined Radio (SDR) media driver
Multiple stable Linux kernel branches referenced in upstream commits
Systems using vb2-based V4L2 USB SDR receivers

Discovery Timeline

2026-08-10 - CVE-2026-68231 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68231

Vulnerability Analysis

The airspy driver implements a V4L2 SDR interface on top of the vb2 buffer management framework. The vb2 framework passes buffers to the driver through buf_queue() before invoking start_streaming(). Drivers must return any accepted buffers via vb2_buffer_done() if start_streaming() fails, otherwise vb2 detects the imbalance through WARN_ON(owned_by_drv_count) and the buffers remain owned by the driver indefinitely.

In the airspy path, when the USB device disconnects (s->udev == NULL), airspy_start_streaming() returned -ENODEV immediately without walking s->queued_bufs to release outstanding buffers. This leaves the vb2 accounting in an inconsistent state and leaks kernel memory tied to those buffers.

Root Cause

The root cause is missing error-path cleanup in airspy_start_streaming(). The function did not honor the vb2 contract requiring buffers accepted through buf_queue() to be returned to vb2 when streaming initialization fails.

Attack Vector

A local user with permission to open the airspy character device can queue buffers and then disconnect or unbind the USB device before streaming starts. Each triggered path produces a kernel warning and leaks memory. Repeated triggering exhausts kernel resources and can support local denial-of-service conditions.

No verified public exploit code is available. The patch reorders locking to acquire v4l2_lock first and routes the -ENODEV path through the existing err_clear_bit label, which drains s->queued_bufs via vb2_buffer_done(..., VB2_BUF_STATE_QUEUED) before releasing the lock. See the Linux Kernel Commit 04344d0b and related backports for the exact patch content.

Detection Methods for CVE-2026-68231

Indicators of Compromise

Kernel log entries containing WARN_ON traces originating from vb2_start_streaming() referencing owned_by_drv_count.
Repeated -ENODEV return paths in airspy_start_streaming() correlated with USB disconnect events in dmesg.
Gradual growth of unreclaimed kernel slab memory tied to vb2 buffer allocations on hosts with airspy hardware.

Detection Strategies

Monitor kernel ring buffer output for WARN_ON stack traces referencing vb2_start_streaming and the airspy module.
Track USB disconnect events on airspy interfaces alongside V4L2 streaming attempts to identify races.
Inventory hosts running vulnerable kernel versions with the airspy module loaded (lsmod | grep airspy).

Monitoring Recommendations

Ship /var/log/kern.log and journalctl -k output to a centralized logging platform and alert on vb2-related WARN traces.
Baseline kernel slab memory consumption on SDR-capable hosts and alert on sustained upward drift.
Audit which local accounts and groups can access /dev/swradio* device nodes exposed by the driver.

How to Mitigate CVE-2026-68231

Immediate Actions Required

Apply the upstream kernel patch or vendor-supplied backport that adds proper buffer release on the airspy_start_streaming() error path.
Unload the airspy module (modprobe -r airspy) on systems that do not require SDR functionality.
Restrict access to /dev/swradio* device nodes to trusted administrative users only.

Patch Information

Fixes are available across multiple stable branches. Refer to Linux Kernel Commit 04344d0b, Linux Kernel Commit 170fcc94, Linux Kernel Commit 73bd2779, Linux Kernel Commit 877686a7, and Linux Kernel Commit cd42623d for the backported changes. Track your distribution's kernel security advisories for packaged updates.

Workarounds

Blacklist the airspy module on hosts that do not use Software Defined Radio hardware by adding blacklist airspy to /etc/modprobe.d/.
Physically remove or disable USB SDR devices on production systems until patched kernels are deployed.
Limit local user access on multi-user Linux hosts, since exploitation requires local device access.

bash

# Configuration example - blacklist the airspy driver until patched
echo 'blacklist airspy' | sudo tee /etc/modprobe.d/blacklist-airspy.conf
sudo modprobe -r airspy 2>/dev/null || true
sudo update-initramfs -u