CVE-2026-68204

A flaw was found in the Linux kernel's media subsystem, specifically within the vivid driver. The vividupdateformatcap/out functions, which handle video format changes, can be called when the video buffer queue is actively processing data. This occurs because checks for a busy queue are missing...

CVE-2026-68222

In the Linux kernel, the following vulnerability has been resolved: media: msi2500: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers vi...

EUVD-2026-55329

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Move srcbuf Removal to finishencode During encoder processing, there is a case where the IRQ response could return the buffer back to userspace via v4l2m2mbufdone call. In this time, userspace could que...

CVE-2026-68222

CVE-2026-68222 describes a Linux kernel asyncio path issue in the media driver msi2500 where start_streaming() errors could leak queued buffers if not returned via vb2_buffer_done(). The kernel fix consolidates five error paths into a small goto chain, drains the queued-buffer list on failure, an...

CVE-2026-68216 media: pwc: Return queued buffers on start_streaming() failure

In the Linux kernel, the following vulnerability has been resolved: media: pwc: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers via...

CVE-2026-68213 media: rtl2832_sdr: Return queued buffers on start_streaming() failure

In the Linux kernel, the following vulnerability has been resolved: media: rtl2832sdr: Return queued buffers on startstreaming failure The vb2 framework hands buffers to the driver via bufqueue before calling startstreaming. If startstreaming returns an error without first returning those buffers...

CVE-2026-68213

CVE-2026-68213 affects the Linux kernel rtl2832_sdr driver in the media subsystem. On start_streaming() failure, buffers queued via vb2 are not returned, causing a leak and potential resource exhaustion. The patch adds an explicit success exit and calls rtl2832_sdr_cleanup_queued_bufs() at error ...

media: videobuf2: Set vma_flags in vb2_dma_sg_mmap

...

CVE-2026-46312

In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: Set vmaflags in vb2dmasgmmap vb2dmacontig sets VMA flags VMDONTEXPAND and VMDONTDUMP and I do not see a reason why vb2dmasg should behave differently. This avoids hitting WARNON!vma-vmflags & VMDONTEXPAND; in...

EUVD-2026-35122

In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: Set vmaflags in vb2dmasgmmap vb2dmacontig sets VMA flags VMDONTEXPAND and VMDONTDUMP and I do not see a reason why vb2dmasg should behave differently. This avoids hitting WARNON!vma-vmflags & VMDONTEXPAND; in...

EUVD-2026-24825

In the Linux kernel, the following vulnerability has been resolved: media: mc, v4l2: serialize REINIT and REQBUFS with reqqueuemutex MEDIAREQUESTIOCREINIT can run concurrently with VIDIOCREQBUFS0 queue teardown paths. This can race request object cleanup against vb2 queue cancellation and lead to...

CVE-2026-33986 FreeRDP: H.264 YUV Buffer Dimension Desync - Heap OOB Write

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, in yuvensurebuffer in libfreerdp/codec/h264.c, h264-width and h264-height are updated before the reallocation loop. If any winpralignedrecalloc call fails, the function returns FALSE but width/height are...

The vulnerability in the nvidia_setup_i2c_bus() function of the drivers/video/fbdev/nvidia/nv_i2c.c driver module allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information within the Linux operating system’s kernel video buffer device.

The vulnerability of the nvidiasetupi2cbus function in the drivers/video/fbdev/nvidia/nvi2c.c driver module relates to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this vulnerability could allow an attacker to compromise the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000600)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000600 advisory. drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a denial of service kernel memory write operation or possibly...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003025)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003025 advisory. drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a denial of service kernel memory write operation or possibly...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: forbid removing buffers when legacy fileio is active The vb2ioctlremovebufs call manipulates the internal buffer list of the queue. This may potentially overwrite pointers used by the legacy fileio interface...

EUVD-2025-201643

In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: forbid removebufs when legacy fileio is active vb2ioctlremovebufs call manipulates queue internal buffer list, potentially overwriting some pointers used by the legacy fileio access mode. Forbid that ioctl when...

CVE-2025-40302 media: videobuf2: forbid remove_bufs when legacy fileio is active

In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: forbid removebufs when legacy fileio is active vb2ioctlremovebufs call manipulates queue internal buffer list, potentially overwriting some pointers used by the legacy fileio access mode. Forbid that ioctl when...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989604)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989604 advisory. In the Linux kernel, the following vulnerability has been resolved: media: stk1160: If start stream fails, return buffers with VB2BUFSTATEQUEUED If the callback...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989517)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989517 advisory. In the Linux kernel, the following vulnerability has been resolved: media: stk1160: If start stream fails, return buffers with VB2BUFSTATEQUEUED If the callback...