SB20260812334 - Improper resource shutdown or release in Linux kernel st stm32 driver

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-68210)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource shutdown or release in the stm32 dcmi driver async notifier handling when probing the device and reset operations fail. A local user can trigger a probe failure to cause a denial of service.

The issue occurs because the notifier remains registered on the error path when probe exits before the normal remove path is reached.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/084973ebd67b28f0945c5d45408f86c58b540110
• https://git.kernel.org/stable/c/37ff63c5d7119cbc5c6bacdcc658add6008a8e1f
• https://git.kernel.org/stable/c/4b7ee504969e074725e439c949f2483e5fa5572a
• https://git.kernel.org/stable/c/6c6f22b7e6cbc4e8c1e359fc9b190419391c3db7
• https://git.kernel.org/stable/c/931abe1deb65b919d23fa203d7f6d6fbd4fccd8e