CVE-2026-43290 Git CVE debrief

Who should care

Linux kernel and distro maintainers, endpoint administrators, and teams managing systems that use USB webcams or other uvcvideo-backed capture devices, especially where local users can start camera streams.

Technical summary

The vulnerability is in the Linux kernel's uvcvideo driver when start_streaming() fails after a uvc_pm_get() error. In that failure path, queued buffers were not returned to the caller, leaving the videobuf2 streaming setup in an invalid state and potentially triggering a kernel warning in vb2_start_streaming(). The supplied CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, so the published severity is HIGH, but the narrative evidence specifically describes a failed cleanup path and warning behavior rather than exploitation details.

Defensive priority

Medium-High

Recommended defensive actions

• Apply the kernel fix referenced by the linked stable kernel commits and ensure your distribution has backported the change.
• Prioritize patching on systems with active USB camera/video-capture use, especially endpoints or kiosks where local users can access /dev/video* devices.
• Monitor kernel logs for warnings involving vb2_start_streaming, uvcvideo, or unexpected USB disconnect and host-controller reset events.
• If patching is delayed, restrict local access to video devices and reduce unnecessary exposure of USB camera functionality on shared systems.
• Verify the running kernel version against your vendor's advisory or backport status before assuming the issue is resolved.

Evidence notes

This debrief is based only on the supplied NVD/CVE corpus and the official kernel stable references listed there. The CVE was published on 2026-05-08 and modified on 2026-05-11. NVD's supplied vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The description explicitly identifies the fix area as 'media: uvcvideo: Return queued buffers on start_streaming() failure' and says queued buffers should be returned when uvc_pm_get() fails. No KEV entry is listed in the supplied enrichment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.