CVE-2026-68216

A flaw was found in the Linux kernel's pwc media driver. When the start_streaming() function fails, it does not properly return queued buffers, leading to a resource leak. This can occur if the USB device is disconnected or if a mutex lock is interrupted. A local attacker could potentially exploit this to cause a Denial of Service (DoS) due to resource exhaustion.

This issue affects systems using Philips WebCam (pwc) USB cameras. If start_streaming() fails after buffers are queued, those buffers are not returned to videobuf2, causing a buffer leak. Systems without pwc hardware are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the pwc module from loading. See https://access.redhat.com/solutions/41278 for instructions.