CVE-2026-68209

In the Linux kernel, the following vulnerability has been resolved:

media: sun4i-csi: Return queued buffers on start_streaming() failure

The vb2 framework hands buffers to the driver via bufqueue() before calling startstreaming(). If startstreaming() returns an error without first returning those buffers via vb2bufferdone(), vb2startstreaming() fires WARNON(ownedbydrv_count) and the queued buffers leak.

sun4icsistartstreaming() returned -EINVAL when no matching CSI format could be found, before any setup (scratch buffer allocation, pipeline start) had been performed. The remaining error paths already converge on the errcleardmaqueue label, which calls returnallbuffers(..., VB2BUFSTATEQUEUED) under csi->qlock. Jump to that label directly: the intermediate errdisabledevice / errdisablepipeline / errfreescratchbuffer labels are skipped, which is correct because nothing they would undo has happened yet.

This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").