CVE-2026-68210
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In the Linux kernel, the stm32 dcmi driver (camera) has a notifier leak on probe failure. If notifier registration succeeds but later steps fail, the notifier is not unregistered, leading to a leak.
Risk Assessment
The organization may face issues with camera management, and the notifier leak could lead to system instability.
Recommendation
Apply a Linux kernel update containing the fix that unregisters the notifier in the probe error path.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: unregister notifier on probe failure dcmi_graph_init() registers the async notifier before dcmi_probe() toggles the reset line. If reset_control_assert() or reset_control_deassert() fails afterwards, probe returns through err_cleanup and the driver core will not call dcmi_remove(). Unregister the notifier before cleaning it up on that error path, matching the successful remove path and the V4L2 async notifier lifetime rules. [hverkuil: added Fixes tag]