CVE-2026-68203
media: vivid: fix cleanup bugs in vivid_init()
Description
In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vivid_init() When platform_device_register() fails in vivid_init(), the embedded struct device in vivid_pdev has already been initialized by device_initialize(), but the failure path jumps to free_output_strings without dropping the device reference for the current platform device: vivid_init() -> platform_device_register(&vivid_pdev) -> device_initialize(&vivid_pdev.dev) -> setup_pdev_dma_masks(&vivid_pdev) -> platform_device_add(&vivid_pdev) This leads to a reference leak when platform_device_register() fails. Fix this by calling platform_device_put() before jumping to the common cleanup path. Also, the unreg_driver label incorrectly calls platform_driver_register() instead of platform_driver_unregister(), which breaks cleanup when workqueue creation fails after successful driver registration. Fix that as well. The reference leak was identified by a static analysis tool I developed and confirmed by manual review. The incorrect cleanup call was found during code inspection.
INFO
Published Date :
Aug. 10, 2026, 1:20 p.m.
Last Modified :
Aug. 17, 2026, 5:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Update the Linux kernel to the latest stable version.
- Ensure platform device registration and cleanup logic is correct.
- Verify driver unregistration functions are called properly.
- Test the fix in a staging environment.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-68203.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-68203 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-68203
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-68203 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-68203 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f46d740fb0258982f00ffdbddc6486e674edafb5', 'lessThan': '4385092a86b94e1f332db35a3766108978c0722f', 'versionType': 'git'}, {'status': 'affected', 'version': 'f46d740fb0258982f00ffdbddc6486e674edafb5', 'lessThan': '1349af7f87df57940619f5b87990b799dac9ed8a', 'versionType': 'git'}, {'status': 'affected', 'version': 'f46d740fb0258982f00ffdbddc6486e674edafb5', 'lessThan': '6d51ad8f1c50c50d1abcc97fd243179967184c6a', 'versionType': 'git'}, {'status': 'affected', 'version': 'f46d740fb0258982f00ffdbddc6486e674edafb5', 'lessThan': 'a07c179a92e949172ca52f6d4a13202ea88cd4b7', 'versionType': 'git'}], 'programFiles': ['drivers/media/test-drivers/vivid/vivid-core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.1'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/media/test-drivers/vivid/vivid-core.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f46d740fb0258982f00ffdbddc6486e674edafb5', 'lessThan': '4385092a86b94e1f332db35a3766108978c0722f', 'versionType': 'git'}, {'status': 'affected', 'version': 'f46d740fb0258982f00ffdbddc6486e674edafb5', 'lessThan': '1349af7f87df57940619f5b87990b799dac9ed8a', 'versionType': 'git'}, {'status': 'affected', 'version': 'f46d740fb0258982f00ffdbddc6486e674edafb5', 'lessThan': '6d51ad8f1c50c50d1abcc97fd243179967184c6a', 'versionType': 'git'}, {'status': 'affected', 'version': 'f46d740fb0258982f00ffdbddc6486e674edafb5', 'lessThan': 'a07c179a92e949172ca52f6d4a13202ea88cd4b7', 'versionType': 'git'}], 'programFiles': ['drivers/media/test-drivers/vivid/vivid-core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.1'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/media/test-drivers/vivid/vivid-core.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 10, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f46d740fb0258982f00ffdbddc6486e674edafb5', 'lessThan': '4385092a86b94e1f332db35a3766108978c0722f', 'versionType': 'git'}, {'status': 'affected', 'version': 'f46d740fb0258982f00ffdbddc6486e674edafb5', 'lessThan': '1349af7f87df57940619f5b87990b799dac9ed8a', 'versionType': 'git'}, {'status': 'affected', 'version': 'f46d740fb0258982f00ffdbddc6486e674edafb5', 'lessThan': '6d51ad8f1c50c50d1abcc97fd243179967184c6a', 'versionType': 'git'}, {'status': 'affected', 'version': 'f46d740fb0258982f00ffdbddc6486e674edafb5', 'lessThan': 'a07c179a92e949172ca52f6d4a13202ea88cd4b7', 'versionType': 'git'}], 'programFiles': ['drivers/media/test-drivers/vivid/vivid-core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.1'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/media/test-drivers/vivid/vivid-core.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: media: vivid: fix cleanup bugs in vivid_init() When platform_device_register() fails in vivid_init(), the embedded struct device in vivid_pdev has already been initialized by device_initialize(), but the failure path jumps to free_output_strings without dropping the device reference for the current platform device: vivid_init() -> platform_device_register(&vivid_pdev) -> device_initialize(&vivid_pdev.dev) -> setup_pdev_dma_masks(&vivid_pdev) -> platform_device_add(&vivid_pdev) This leads to a reference leak when platform_device_register() fails. Fix this by calling platform_device_put() before jumping to the common cleanup path. Also, the unreg_driver label incorrectly calls platform_driver_register() instead of platform_driver_unregister(), which breaks cleanup when workqueue creation fails after successful driver registration. Fix that as well. The reference leak was identified by a static analysis tool I developed and confirmed by manual review. The incorrect cleanup call was found during code inspection. Added Reference https://git.kernel.org/stable/c/1349af7f87df57940619f5b87990b799dac9ed8a Added Reference https://git.kernel.org/stable/c/4385092a86b94e1f332db35a3766108978c0722f Added Reference https://git.kernel.org/stable/c/6d51ad8f1c50c50d1abcc97fd243179967184c6a Added Reference https://git.kernel.org/stable/c/a07c179a92e949172ca52f6d4a13202ea88cd4b7