CVE-2026-68211

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> media: stm32-dcmipp: Return queued buffers on start_streaming() failure<br /> <br /> The vb2 framework hands buffers to the driver via buf_queue() before<br /> calling start_streaming(). If start_streaming() returns an error<br /> without first returning those buffers via vb2_buffer_done(),<br /> vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued<br /> buffers leak.<br /> <br /> dcmipp_bytecap_start_streaming() returned -EINVAL when the source<br /> subdevice could not be resolved from the media graph, before<br /> pm_runtime_resume_and_get() and media_pipeline_start() had been called.<br /> The remaining error paths already converge on the err_buffer_done<br /> label, which calls dcmipp_bytecap_all_buffers_done(...,<br /> VB2_BUF_STATE_QUEUED). Jump to that label directly: the intermediate<br /> err_pm_put / err_media_pipeline_stop labels are skipped, which is<br /> correct because nothing they would undo has happened yet.<br /> <br /> This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo:<br /> Return queued buffers on start_streaming() failure").