CVE-2026-68207 media: ti: vpe: unwind v4l2 device registration on probe error
A resource leak in the TI VPE driver probe error path can lead to system instability or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68207?
CVE-2026-68207 is a vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
media: ti: vpe: unwind v4l2 device registration on probe error
If the vpe_top resource is missing, vpe_probe() returns -ENODEV after v4l2_device_register() has succeeded. Probe failures do not call the driver's remove callback, so the v4l2 device remains registered on that error path.
Route that failure through the existing v4l2_device_unregister() unwind label, matching the other errors after v4l2_device_register().
Which versions are affected by CVE-2026-68207?
How do I fix CVE-2026-68207?
Apply the vendor's patch.
Is CVE-2026-68207 being exploited?
There is no known exploitation of CVE-2026-68207 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68207, DEBIAN-CVE-2026-68207, GHSA-9fcx-rhjm-5qjm, UBUNTU-CVE-2026-68207.