media: chips-media: wave5: Move src_buf Removal to finish_encode
In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Move src_buf Removal to finish_encode During encoder processing, there is a case where the IRQ response could return the buffer back to userspace via v4l2_m2m_buf_done call. In this time, userspace could queue up this same buffer before start_encode removes the index from the ready queue. This would then lead to a case where the buffer in the ready queue could be a self loop due to the WRITE_ONCE(prev->next, new) call in __list_add. When __list_del is finally called, the loop is already made so nothing points back to ready queue list head and pointers are poisoned. A buffer should not be marked as DONE before the buffer is removed from m2m ready queue. Move removal entirely to finish_encode.
CVE-2026-68228
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:CVE-2026-68228
Kernel
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 6.12.101
Source reference:
/affected/1/ranges6.18.42Source reference:
/affected/1/ranges7.1.6Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "9707a6254a8a6b978bde811a44fe07d86c229d1c"
},
{
"fixed": "1ee2b2b189ddc7b23c8eee1145de42b8bd19fb06"
},
{
"fixed": "f24ca8b53fe15db40957bdaa40c9aa68e1557bbe"
},
{
"fixed": "d681227ce43bfd74b6eb69beecd9b0bec1fd8b48"
},
{
"fixed": "b20157147089a9c16a38c7810e2fe6f2df8e3277"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68228.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.8.0"
},
{
"fixed": "6.12.101"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.42"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.1.6"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68228.json"
}
}
]- Related CVEs
- CVE-2026-68228
Source reference:
/id
Publisher severity
No explicit severity was provided.
- Event
- #50656 · Revision 1
- Added to Heist Feed
- Publisher date