SB20260812313 - Improper resource shutdown or release in Linux kernel usb msi2500 driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-68222)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown in msi2500_start_streaming() and queued buffer cleanup handling when starting streaming after buffers have been queued by the vb2 framework. A local user can trigger start_streaming() error paths to cause a denial of service.

The issue occurs on multiple start_streaming() failure paths, including device disconnect, interrupted locking, USB ADC setup failure, isochronous initialization failure, and streaming command failure. In some cases, queued buffers are not returned as expected and submitted isochronous URBs may remain active without being consumable by the driver.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1d58229b330b7f67fbfa07e0f2a8a51fbeafaa9a
• https://git.kernel.org/stable/c/264b5380c4f8aa92dbc2983ecd2b627f1d5e0061
• https://git.kernel.org/stable/c/3673cb0a5711e910074d69201da9e1535c03f97a
• https://git.kernel.org/stable/c/7201c17786a498497bca57752883b90914d405ac
• https://git.kernel.org/stable/c/bab9d5a67d4db96ae8c187b92b37979911302a10