Security readout for executives and security teams
Plain-English summary
A Linux camera-driver error can mishandle queued video buffers when USB video streaming fails to start. The supplied record rates it 7.8/high, but the public description documents a kernel warning and controller failure, not a demonstrated compromise. Systems using affected kernels and UVC video devices deserve timely patching.
Executive priority
Schedule prompt remediation on affected endpoints, kiosks, appliances, and multi-user systems with USB cameras. Treat internet-only servers without UVC devices as lower immediate priority. Escalate if vendor telemetry or advisories later establish reliable exploitation or broader impact.
Technical view
In uvcvideo, a uvc_pm_get() failure during start_streaming() could leave queued videobuf2 buffers unreturned, triggering a warning in vb2_start_streaming(). The fix returns those buffers on failure. The reporter observed an xHCI controller dying under repeated video capture but could not reproduce it again.
Likely exposure
Exposure requires an affected Linux kernel and local interaction with a UVC video device. The bundle lists 6.17, 6.18.16, 6.19.6, and 7.0 as affected, but also contains an ambiguous “0” entry; confirm exact affected ranges with the kernel or distribution vendor.
Exploitation context
The CVSS vector describes local, low-complexity, low-privilege access without user interaction. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. Documented behavior is limited to a warning and USB controller failure during repeated capture attempts.
Researcher notes
Impact confidence is constrained: the 7.8 vector claims high confidentiality, integrity, and availability effects, while the narrative only reports a non-reproducible warning and controller death. No CWE is supplied. The duplicated commit identifier and ambiguous affected-version data warrant verification against stable-tree and distribution mappings.
Mitigation direction
- Install a vendor kernel update containing the applicable referenced stable fix.
- Consult distribution advisories to confirm affected and corrected package versions.
- Restrict unnecessary local access to UVC video devices until patched.
- Prioritize shared systems where untrusted local users can access camera devices.
Validation and detection
- Record the running kernel and distribution package versions.
- Check whether UVC video hardware and the uvcvideo module are present.
- Confirm the installed kernel includes the applicable referenced stable commit.
- Review kernel logs for uvcvideo, videobuf2, xHCI, or USB disconnect warnings.
- Recheck exposure against the Linux distribution’s authoritative advisory.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43290 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/69c32df23bed6001864779b965fa009bcd9a26deCVE reference, Linux
- https://git.kernel.org/stable/c/a5c01f15809d1d2c319d8bfb11d071df11ab731cCVE reference, Linux
- https://git.kernel.org/stable/c/4cf3b6fd54ebb1ebc977bdc47fb6cfcf9a471a22CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.