Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-95166.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-95166
Upstream
Published
2026-08-10T13:20:07Z
Modified
2026-09-01T05:28:09Z
Summary
CVE-2026-68203 affecting package kernel 6.6.150.1-1
Details

In the Linux kernel, the following vulnerability has been resolved:

media: vivid: fix cleanup bugs in vivid_init()

When platformdeviceregister() fails in vividinit(), the embedded struct device in vividpdev has already been initialized by deviceinitialize(), but the failure path jumps to freeoutput_strings without dropping the device reference for the current platform device:

vividinit() -> platformdeviceregister(&vividpdev) -> deviceinitialize(&vividpdev.dev) -> setuppdevdmamasks(&vividpdev) -> platformdeviceadd(&vivid_pdev)

This leads to a reference leak when platformdeviceregister() fails. Fix this by calling platformdeviceput() before jumping to the common cleanup path.

Also, the unregdriver label incorrectly calls platformdriverregister() instead of platformdriver_unregister(), which breaks cleanup when workqueue creation fails after successful driver registration. Fix that as well.

The reference leak was identified by a static analysis tool I developed and confirmed by manual review. The incorrect cleanup call was found during code inspection.

References

Affected packages

Azure Linux:3 / kernel

Package

Name
kernel
Purl
pkg:rpm/azure-linux/kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
6.6.150.1-1

Database specific

source
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-95166.json"