CVE-2026-68210 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
media: stm32: dcmi: unregister notifier on probe failure
dcmi_graph_init() registers the async notifier before dcmi_probe() toggles the reset line. If reset_control_assert() or reset_control_deassert() fails afterwards, probe returns through err_cleanup and the driver core will not call dcmi_remove().
Unregister the notifier before cleaning it up on that error path, matching the successful remove path and the V4L2 async notifier lifetime rules.
[hverkuil: added Fixes tag]
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists in the Linux kernel's stm32 dcmi media driver where improper handling of asynchronous notifiers during device probe failure creates a potential resource management issue. The problem occurs when dcmi_graph_init() registers an async notifier before dcmi_probe() attempts to control the reset line through reset_control_assert() or reset_control_deassert(). When these reset operations fail, the probe function returns through the err_cleanup path without properly unregistering the notifier, leaving the notifier in a state where it may not be correctly cleaned up during device removal.
The technical flaw stems from inconsistent notifier lifecycle management between successful and failed probe paths. In the successful removal path, the driver properly unregisters the notifier before cleanup operations occur, but during error conditions in the probe sequence, this unregister step is omitted. This creates a mismatch in how the V4L2 async notifier framework manages its lifetime, potentially leading to resource leaks or inconsistent state management when the device is later removed from the system.
The operational impact of this vulnerability could manifest as improper cleanup of asynchronous notifiers during device removal scenarios, which might result in memory leaks or unexpected behavior in the media subsystem. When a device probe fails due to reset line control issues, the driver's failure path does not properly clean up registered notifiers, potentially causing issues when the driver core attempts to call dcmi_remove() later. This inconsistency can lead to resource management problems that may affect system stability and proper device lifecycle handling within the Linux kernel's media framework.
The recommended mitigation involves ensuring that the async notifier is unregistered before cleanup operations occur on the error path, aligning the probe failure handling with the successful removal path behavior. This approach maintains consistency with V4L2 async notifier lifetime rules and ensures proper resource management throughout all driver execution paths. The fix addresses a specific category of vulnerability related to improper resource cleanup and lifecycle management, which aligns with CWE-459 and CWE-704 categories focusing on incomplete cleanup and improper handling of asynchronous operations. This vulnerability type falls under ATT&CK technique T1547.001 for registry run keys and T1068 for exploit for privilege escalation through kernel module manipulation, though the immediate impact is more focused on resource management than direct privilege escalation.