CVE-2026-68217: media: pwc: Drain fill_buf on start_streaming() failure

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

media: pwc: Drain fill_buf on start_streaming() failure

pwc_isoc_init() submits its isochronous URBs with
usb_submit_urb(.., GFP_KERNEL) in a loop. After the first URB is
submitted, its completion handler pwc_isoc_handler() can run on another
CPU before the loop finishes:

  start_streaming()
    pwc_isoc_init()
      usb_submit_urb(urbs[0], GFP_KERNEL)
                                  pwc_isoc_handler(urbs[0])
                                    pdev->fill_buf =
                                      pwc_get_next_fill_buf(pdev)
      usb_submit_urb(urbs[i>0], ..)  -> fails
      pwc_isoc_cleanup(pdev)           /* kills URBs */
      return ret;
    pwc_cleanup_queued_bufs(pdev, VB2_BUF_STATE_QUEUED)

pwc_get_next_fill_buf() detaches a buffer from pdev->queued_bufs and
stores it in pdev->fill_buf. The error path in start_streaming() only
drains pdev->queued_bufs, so the buffer parked in pdev->fill_buf is
leaked. vb2_start_streaming() then triggers
WARN_ON(owned_by_drv_count).

stop_streaming() already handles this since commit 80b0963e1698
("[media] pwc: fix WARN_ON"), which added the fill_buf drain in the
teardown path but not in the start_streaming() error path. Mirror that
handling on failure so start_streaming() returns with no buffer owned
by the driver.

Issue identified by automated review of the INV-003 series at
https://sashiko.dev/

The Linux kernel CVE team has assigned CVE-2026-68217 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.1 with commit 885fe18f5542fe283a17f70583383c6cadcba1c3 and fixed in 6.6.148 with commit a56e7641e09bd80b976e944ae759109b86fd5b38
	Issue introduced in 3.1 with commit 885fe18f5542fe283a17f70583383c6cadcba1c3 and fixed in 6.12.101 with commit acc789b2173070638cad89c2b61d33ed338be0dd
	Issue introduced in 3.1 with commit 885fe18f5542fe283a17f70583383c6cadcba1c3 and fixed in 6.18.42 with commit 9afd605dcd96c7a45f338eded1de16679b30e1df
	Issue introduced in 3.1 with commit 885fe18f5542fe283a17f70583383c6cadcba1c3 and fixed in 7.1.6 with commit 5d4812668b03f823b5044789d6aa77fe56b42587
	Issue introduced in 3.1 with commit 885fe18f5542fe283a17f70583383c6cadcba1c3 and fixed in 7.2-rc1 with commit 906e410dcffbbd99fb4081abab817a830033aa28

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68217
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/media/usb/pwc/pwc-if.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a56e7641e09bd80b976e944ae759109b86fd5b38
	https://git.kernel.org/stable/c/acc789b2173070638cad89c2b61d33ed338be0dd
	https://git.kernel.org/stable/c/9afd605dcd96c7a45f338eded1de16679b30e1df
	https://git.kernel.org/stable/c/5d4812668b03f823b5044789d6aa77fe56b42587
	https://git.kernel.org/stable/c/906e410dcffbbd99fb4081abab817a830033aa28