CVE-2026-68216

In the Linux kernel, the following vulnerability has been resolved:

media: pwc: Return queued buffers on start_streaming() failure

The vb2 framework hands buffers to the driver via bufqueue() before calling startstreaming(). If startstreaming() returns an error without first returning those buffers via vb2bufferdone(), vb2startstreaming() fires WARNON(ownedbydrv_count) and the queued buffers leak.

pwc's startstreaming() had two early returns that hit this trap: -ENODEV when the USB device was already disconnected, and -ERESTARTSYS when mutexlockinterruptible() was interrupted by a signal. Call the existing pwccleanupqueuedbufs() helper with VB2BUFSTATEQUEUED before returning (matching the state already used by the pwcisoc_init() error path in the same function).

This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").