CVE-2026-68204

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: vivid: check for vb2_is_busy() when toggling caps<br /> <br /> The vivid_update_format_cap/out() functions must only be called if the<br /> capture/output queue are not busy. But for the controls that select<br /> the CROP/COMPOSE/SCALE capability that is not checked.<br /> <br /> Only when streaming starts will they be set to &amp;#39;grabbed&amp;#39; and it is<br /> impossible to change the control, but between REQBUFS and STREAMON you<br /> are still allowed to set these controls. Since vivid_update_format_cap/out<br /> will change the format, this can cause unexpected results.<br /> <br /> Besides adding these checks, also add a WARN_ON in<br /> vivid_update_format_cap/out() if the queue is busy.<br /> <br /> I&amp;#39;m 90% certain that this is the cause of this syzbot bug:<br /> <br /> https://syzkaller.appspot.com/bug?extid=dac8f5eaa46837e97b89<br /> <br /> But since we never have reproducers, it is hard to be certain. In any case,<br /> these checks are needed regardless.