CVE-2026-68228

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the wave5 media component where a buffer may be returned to userspace via the v4l2 m2m buf done() function before it is removed from the m2m ready queue. This allows userspace to re-queue the same buffer while it is still in the ready queue, potentially causing a self-loop during the list add() operation due to the WRITE ONCE(prev->next, new) call. Consequently, when list del() is executed, the list head is no longer reachable and pointers become poisoned.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.