CVE-2026-68210

Received Received - Intake

DCMI Probe Failure Unregisters Async Notifier in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: unregister notifier on probe failure dcmi_graph_init() registers the async notifier before dcmi_probe() toggles the reset line. If reset_control_assert() or reset_control_deassert() fails afterwards, probe returns through err_cleanup and the driver core will not call dcmi_remove(). Unregister the notifier before cleaning it up on that error path, matching the successful remove path and the V4L2 async notifier lifetime rules. [hverkuil: added Fixes tag]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68210

EUVD

EUVD-2026-55311

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the STM32 DCMI driver. During probe, an async notifier is registered before the reset line is toggled. If the reset control operations fail, the probe exits without unregistering the notifier. This leaves the notifier registered improperly, violating V4L2 async notifier lifetime rules.

Detection Guidance

This vulnerability is specific to the Linux kernel's STM32 DCMI driver and does not have network-based detection methods. To detect it, check kernel logs for DCMI driver probe failures or reset control errors using commands like dmesg | grep dcmi or journalctl -k | grep dcmi.

Impact Analysis

This flaw could cause system instability or unexpected behavior in systems using the STM32 DCMI driver. It may lead to resource leaks, improper device initialization, or crashes during driver probe if reset control fails.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel driver issue related to improper cleanup during probe failure, which could lead to system instability but does not involve data handling or privacy concerns.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this vulnerability. Monitor kernel logs for DCMI driver probe failures and ensure proper reset control operations during driver initialization.

Hi! I’m here to help you understand CVE-2026-68210. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70