Bug 2513187 (CVE-2026-68210)

Summary:	CVE-2026-68210 kernel: media: stm32: dcmi: unregister notifier on probe failure
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's `media: stm32: dcmi` driver. When the `dcmi_graph_init()` function fails to initialize due to issues with `reset_control_assert()` or `reset_control_deassert()`, an asynchronous notifier is not properly unregistered. This oversight can lead to resource leaks, potentially causing system instability or a denial of service (DoS) condition.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-10 12:23:55 UTC

In the Linux kernel, the following vulnerability has been resolved:

media: stm32: dcmi: unregister notifier on probe failure

dcmi_graph_init() registers the async notifier before dcmi_probe() toggles
the reset line. If reset_control_assert() or reset_control_deassert()
fails afterwards, probe returns through err_cleanup and the driver core
will not call dcmi_remove().

Unregister the notifier before cleaning it up on that error path,
matching the successful remove path and the V4L2 async notifier lifetime
rules.

[hverkuil: added Fixes tag]