CVE-2026-68204

A flaw was found in the Linux kernel's media subsystem, specifically within the vivid driver. The vivid_update_format_cap/out() functions, which handle video format changes, can be called when the video buffer queue is actively processing data. This occurs because checks for a busy queue are missing when certain capabilities are toggled between the buffer request and streaming start phases. An attacker with local access could potentially exploit this to cause unexpected system behavior or instability by manipulating video format settings during an active streaming session.

This issue affects vivid test media driver. CROP/COMPOSE/SCALE capability toggles allowed while vb2 queue is busy. Systems not using vivid are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.