CVE-2026-68231: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-rw4h-36vm-p4p5
Share
Published
Advisory Summary

CVE-2026-68231 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-68231 at a Glance

CVE Identifier CVE-2026-68231
GHSA Identifier GHSA-rw4h-36vm-p4p5
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-68231

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-68231, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: media: airspy: Return queued buffers on start_streaming() failure The vb2 framework hands buffers to the driver via buf_queue() before calling start_streaming(). If start_streaming() returns an error without first returning those buffers via vb2_buffer_done(), vb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued buffers leak. airspy_start_streaming() returned -ENODEV early when the USB device had been disconnected (s->udev == NULL) without returning any buffers that buf_queue() had already accepted. Take v4l2_lock first and jump to the existing err_clear_bit label, which already drains s->queued_bufs via vb2_buffer_done(..., VB2_BUF_STATE_QUEUED) before unlocking. This mirrors the uvcvideo fix in commit 4cf3b6fd54eb ("media: uvcvideo: Return queued buffers on start_streaming() failure").

References

NVD — CVE-2026-68231 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-68231
git.kernel.org/stable/c/04344d0b49... WEB
https://git.kernel.org/stable/c/04344d0b4929caa94c0df72f767752aa0935ef5d
git.kernel.org/stable/c/122ce0c0af... WEB
https://git.kernel.org/stable/c/122ce0c0af629a8765ddf1adf6fb85c6db3d47cb
git.kernel.org/stable/c/170fcc945b... WEB
https://git.kernel.org/stable/c/170fcc945bc094b1c956bf555c070692826a3eff
git.kernel.org/stable/c/73bd277986... WEB
https://git.kernel.org/stable/c/73bd2779865372b1017d4f555b45270aa2d0d710
git.kernel.org/stable/c/877686a74e... WEB
https://git.kernel.org/stable/c/877686a74ecdc93dcaee09dbac566e819059c9e7
git.kernel.org/stable/c/badceeb82a... WEB
https://git.kernel.org/stable/c/badceeb82a9d8d8e98d07859f3c89130ae1998b9
git.kernel.org/stable/c/bcdf261c4c... WEB
https://git.kernel.org/stable/c/bcdf261c4c29077fc3da6449f7eda77357046205
git.kernel.org/stable/c/cd42623d69... WEB
https://git.kernel.org/stable/c/cd42623d698b59f1fe5768f78a4101c28d5feb2e

Frequently Asked Questions

What is CVE-2026-68231?
CVE-2026-68231 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-68231?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-68231?
CVE-2026-68231 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-68231?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-rw4h-36vm-p4p5",
  "modified" : "2026-08-19T18:32:11Z",
  "published" : "2026-08-10T15:33:42Z",
  "aliases" : [ "CVE-2026-68231" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: airspy: Return queued buffers on start_streaming() failure\n\nThe vb2 framework hands buffers to the driver via buf_queue() before\ncalling start_streaming().  If start_streaming() returns an error\nwithout first returning those buffers via vb2_buffer_done(),\nvb2_start_streaming() fires WARN_ON(owned_by_drv_count) and the queued\nbuffers leak.\n\nairspy_start_streaming() returned -ENODEV early when the USB device had\nbeen disconnected (s->udev == NULL) without returning any buffers that\nbuf_queue() had already accepted.  Take v4l2_lock first and jump to the\nexisting err_clear_bit label, which already drains s->queued_bufs via\nvb2_buffer_done(..., VB2_BUF_STATE_QUEUED) before unlocking.\n\nThis mirrors the uvcvideo fix in commit 4cf3b6fd54eb (\"media: uvcvideo:\nReturn queued buffers on start_streaming() failure\").",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-68231"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/04344d0b4929caa94c0df72f767752aa0935ef5d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/122ce0c0af629a8765ddf1adf6fb85c6db3d47cb"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/170fcc945bc094b1c956bf555c070692826a3eff"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/73bd2779865372b1017d4f555b45270aa2d0d710"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/877686a74ecdc93dcaee09dbac566e819059c9e7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/badceeb82a9d8d8e98d07859f3c89130ae1998b9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/bcdf261c4c29077fc3da6449f7eda77357046205"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cd42623d698b59f1fe5768f78a4101c28d5feb2e"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-10T13:20:11Z"
  }
}