7.8

CVE-2026-68204

media: vivid: check for vb2_is_busy() when toggling caps

In the Linux kernel, the following vulnerability has been resolved:

media: vivid: check for vb2_is_busy() when toggling caps

The vivid_update_format_cap/out() functions must only be called if the
capture/output queue are not busy. But for the controls that select
the CROP/COMPOSE/SCALE capability that is not checked.

Only when streaming starts will they be set to 'grabbed' and it is
impossible to change the control, but between REQBUFS and STREAMON you
are still allowed to set these controls. Since vivid_update_format_cap/out
will change the format, this can cause unexpected results.

Besides adding these checks, also add a WARN_ON in
vivid_update_format_cap/out() if the queue is busy.

I'm 90% certain that this is the cause of this syzbot bug:

https://syzkaller.appspot.com/bug?extid=dac8f5eaa46837e97b89

But since we never have reproducers, it is hard to be certain. In any case,
these checks are needed regardless.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 73c3f48230cda01402ae189b05d56f1f7e0d53c9
Version < 0a820f03727b509b887f3216a574062948761f34
Status affected
Version 73c3f48230cda01402ae189b05d56f1f7e0d53c9
Version < bbc96bc75de0fcd9bb6ac48798b206e3b09ec865
Status affected
Version 73c3f48230cda01402ae189b05d56f1f7e0d53c9
Version < 6a5bc8aea111ccbca71ef2b9c868d5c81f2e89de
Status affected
Version 73c3f48230cda01402ae189b05d56f1f7e0d53c9
Version < a9cd0e8fb0b21faaa71199d9d3feb305c18ff576
Status affected
Version 73c3f48230cda01402ae189b05d56f1f7e0d53c9
Version < abaec6747304581f8d4a9936352fa10e13325f07
Status affected
Version 73c3f48230cda01402ae189b05d56f1f7e0d53c9
Version < 492c97cb50feaa60ccd7792d3d6b904ed8ec61bf
Status affected
Version 73c3f48230cda01402ae189b05d56f1f7e0d53c9
Version < daf2d92669b4a659d805d88d811161c70cd325ee
Status affected
Version 73c3f48230cda01402ae189b05d56f1f7e0d53c9
Version < c2d1a2130c93f6d758af58590b86b2254c7a1dec
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 3.18
Status affected
Version 0
Version < 3.18
Status unaffected
Version <= 5.10.*
Version 5.10.265
Status unaffected
Version <= 5.15.*
Version 5.15.216
Status unaffected
Version <= 6.1.*
Version 6.1.183
Status unaffected
Version <= 6.6.*
Version 6.6.148
Status unaffected
Version <= 6.12.*
Version 6.12.101
Status unaffected
Version <= 6.18.*
Version 6.18.42
Status unaffected
Version <= 7.1.*
Version 7.1.6
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.074
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/a9cd0e8fb0b21faaa71199d9d3feb305c18ff576
https://git.kernel.org/stable/c/abaec6747304581f8d4a9936352fa10e13325f07
https://git.kernel.org/stable/c/492c97cb50feaa60ccd7792d3d6b904ed8ec61bf
https://git.kernel.org/stable/c/daf2d92669b4a659d805d88d811161c70cd325ee
https://git.kernel.org/stable/c/c2d1a2130c93f6d758af58590b86b2254c7a1dec
https://git.kernel.org/stable/c/0a820f03727b509b887f3216a574062948761f34
https://git.kernel.org/stable/c/6a5bc8aea111ccbca71ef2b9c868d5c81f2e89de
https://git.kernel.org/stable/c/bbc96bc75de0fcd9bb6ac48798b206e3b09ec865