CVE-2026-68210

What it actually does

Use-after-free in the Linux kernel STM32 DCMI driver when dcmi_graph_init registers an async notifier but a subsequent reset_control failure causes early return through err_cleanup without unregistering it, violating V4L2 notifier lifetime rules.

Why it matters to the business

Local attackers on affected embedded Linux systems can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation with no remote vector or known ransomware use.

How an attack unfolds

An attacker with local access crafts conditions to make dcmi_probe fail after notifier registration (for example by forcing reset_control_assert/deassert errors) so the notifier remains active after the device is torn down, allowing subsequent use of freed memory.

How to fix it

Update to a Linux kernel containing the fix that unregisters the notifier on the probe error path; apply the patch that adds the missing notifier unregister before err_cleanup.

How to confirm the fix worked

Confirm the driver source contains the notifier unregister call on the reset failure path and that dcmi_remove and the error path both follow identical notifier lifetime handling.

Typical attack path

1. Obtain local code execution or shell on the target Linux system
2. Trigger DCMI driver probe under conditions that cause reset_control failure after notifier registration
3. Cause the error path to skip notifier unregistration
4. Trigger subsequent notifier callbacks to access freed structures

How to detect it

Review kernel logs for DCMI probe failures followed by use-after-free warnings or notifier-related crashes; examine call traces involving dcmi_graph_init and reset_control on STM32 platforms.

What your security team should do

• Prioritize kernel updates for systems using STM32 DCMI hardware
• Monitor for local privilege-escalation attempts on affected embedded devices
• Apply the fix from the published commit that resolves the notifier lifetime mismatch