CVE-2026-68210 (GCVE-0-2026-68210)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:00 – Updated: 2026-08-19 16:31
VLAI
Title
media: stm32: dcmi: unregister notifier on probe failure
Summary
In the Linux kernel, the following vulnerability has been resolved: media: stm32: dcmi: unregister notifier on probe failure dcmi_graph_init() registers the async notifier before dcmi_probe() toggles the reset line. If reset_control_assert() or reset_control_deassert() fails afterwards, probe returns through err_cleanup and the driver core will not call dcmi_remove(). Unregister the notifier before cleaning it up on that error path, matching the successful remove path and the V4L2 async notifier lifetime rules. [hverkuil: added Fixes tag]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d079f94c90469f413920b9f2b201537fac2ceb06 , < 222a9301b086852b90d3b092fef436c3f4e927c4 (git)
Affected: d079f94c90469f413920b9f2b201537fac2ceb06 , < 37ff63c5d7119cbc5c6bacdcc658add6008a8e1f (git)
Affected: d079f94c90469f413920b9f2b201537fac2ceb06 , < 6c6f22b7e6cbc4e8c1e359fc9b190419391c3db7 (git)
Affected: d079f94c90469f413920b9f2b201537fac2ceb06 , < 931abe1deb65b919d23fa203d7f6d6fbd4fccd8e (git)
Affected: d079f94c90469f413920b9f2b201537fac2ceb06 , < 4b7ee504969e074725e439c949f2483e5fa5572a (git)
Affected: d079f94c90469f413920b9f2b201537fac2ceb06 , < 084973ebd67b28f0945c5d45408f86c58b540110 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/st/stm32/stm32-dcmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "222a9301b086852b90d3b092fef436c3f4e927c4",
              "status": "affected",
              "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
              "versionType": "git"
            },
            {
              "lessThan": "37ff63c5d7119cbc5c6bacdcc658add6008a8e1f",
              "status": "affected",
              "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
              "versionType": "git"
            },
            {
              "lessThan": "6c6f22b7e6cbc4e8c1e359fc9b190419391c3db7",
              "status": "affected",
              "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
              "versionType": "git"
            },
            {
              "lessThan": "931abe1deb65b919d23fa203d7f6d6fbd4fccd8e",
              "status": "affected",
              "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
              "versionType": "git"
            },
            {
              "lessThan": "4b7ee504969e074725e439c949f2483e5fa5572a",
              "status": "affected",
              "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
              "versionType": "git"
            },
            {
              "lessThan": "084973ebd67b28f0945c5d45408f86c58b540110",
              "status": "affected",
              "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/st/stm32/stm32-dcmi.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: stm32: dcmi: unregister notifier on probe failure\n\ndcmi_graph_init() registers the async notifier before dcmi_probe() toggles\nthe reset line. If reset_control_assert() or reset_control_deassert()\nfails afterwards, probe returns through err_cleanup and the driver core\nwill not call dcmi_remove().\n\nUnregister the notifier before cleaning it up on that error path,\nmatching the successful remove path and the V4L2 async notifier lifetime\nrules.\n\n[hverkuil: added Fixes tag]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The affected code is a platform camera-interface driver probe path on STM32 SoCs; it is reached only through local device/driver binding on the machine itself, with the resulting dangling notifier consumed by in-kernel V4L2 subdev registration. No network or remote data path reaches this code.\nAC:L - Once the driver has probe-failed on the reset line, the stale notifier remains on the global v4l2 notifier_list indefinitely, and any subsequent subdev registration deterministically walks the freed object; no race or unpredictable memory layout must be won to reach the freed dereference.\nPR:L - A local user account on the device is sufficient to interact with the media/V4L2 stack and trigger subdev registration paths that walk the corrupted global notifier list; no root or administrative capability is needed to consume the dangling pointer.\nUI:N - The stale notifier is left behind automatically by the failing probe path and is dereferenced by kernel-internal V4L2 async registration; no victim action such as opening a file or mounting a filesystem is required.\nS:U - The freed memory, the corrupted list, and the resulting impact are all within the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The devm-allocated stm32_dcmi object containing the notifier is freed while still linked into the global notifier_list, so reallocated heap contents are read back as notifier state and traversed as list pointers, which can be leveraged to disclose kernel memory.\nI:H - Traversal and eventual list_del of the freed notifier_entry performs writes through attacker-influenceable heap contents, giving a use-after-free list-corruption primitive that can be shaped into an arbitrary write and control-flow hijack.\nA:H - Dereferencing and unlinking a freed notifier from the global list reliably produces list corruption and an oops or panic in the V4L2 async core, taking down the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:31:34.517Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/222a9301b086852b90d3b092fef436c3f4e927c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/37ff63c5d7119cbc5c6bacdcc658add6008a8e1f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c6f22b7e6cbc4e8c1e359fc9b190419391c3db7"
        },
        {
          "url": "https://git.kernel.org/stable/c/931abe1deb65b919d23fa203d7f6d6fbd4fccd8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b7ee504969e074725e439c949f2483e5fa5572a"
        },
        {
          "url": "https://git.kernel.org/stable/c/084973ebd67b28f0945c5d45408f86c58b540110"
        }
      ],
      "title": "media: stm32: dcmi: unregister notifier on probe failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68210",
    "datePublished": "2026-08-10T12:00:29.515Z",
    "dateReserved": "2026-07-30T09:28:09.375Z",
    "dateUpdated": "2026-08-19T16:31:34.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68210",
      "date": "2026-09-22",
      "epss": "0.00176",
      "percentile": "0.07396"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/st/stm32/stm32-dcmi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "222a9301b086852b90d3b092fef436c3f4e927c4",
                    "status": "affected",
                    "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "37ff63c5d7119cbc5c6bacdcc658add6008a8e1f",
                    "status": "affected",
                    "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6c6f22b7e6cbc4e8c1e359fc9b190419391c3db7",
                    "status": "affected",
                    "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "931abe1deb65b919d23fa203d7f6d6fbd4fccd8e",
                    "status": "affected",
                    "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4b7ee504969e074725e439c949f2483e5fa5572a",
                    "status": "affected",
                    "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "084973ebd67b28f0945c5d45408f86c58b540110",
                    "status": "affected",
                    "version": "d079f94c90469f413920b9f2b201537fac2ceb06",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/st/stm32/stm32-dcmi.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.20"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: stm32: dcmi: unregister notifier on probe failure\n\ndcmi_graph_init() registers the async notifier before dcmi_probe() toggles\nthe reset line. If reset_control_assert() or reset_control_deassert()\nfails afterwards, probe returns through err_cleanup and the driver core\nwill not call dcmi_remove().\n\nUnregister the notifier before cleaning it up on that error path,\nmatching the successful remove path and the V4L2 async notifier lifetime\nrules.\n\n[hverkuil: added Fixes tag]"
          }
        ],
        "id": "CVE-2026-68210",
        "lastModified": "2026-08-19T17:20:36.970",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:08.760",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/084973ebd67b28f0945c5d45408f86c58b540110"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/222a9301b086852b90d3b092fef436c3f4e927c4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/37ff63c5d7119cbc5c6bacdcc658add6008a8e1f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4b7ee504969e074725e439c949f2483e5fa5572a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6c6f22b7e6cbc4e8c1e359fc9b190419391c3db7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/931abe1deb65b919d23fa203d7f6d6fbd4fccd8e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:18:47+00:00",
      "cve": "CVE-2026-68210",
      "id": "CVE-2026-68210",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: stm32: dcmi: unregister notifier on probe failure",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68210.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-22T16:46:22Z",
      "cve": "CVE-2026-68210",
      "id": "CVE-2026-68210",
      "initial_release_date": "2026-08-13T16:22:57Z",
      "product_status:first_fixed": "60",
      "product_status:known_affected": "590",
      "product_status:known_not_affected": "141",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68210",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68210.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.