CVE-2026-68210

CVE-2026-68210 is a lifecycle ordering bug in the STM32 DCMI camera driver where probe failure leaves a V4L2 async notifier in a dangerous limbo state. The vulnerability: when reset_control_assert or reset_control_deassert fails during probe, the error path at 'err_cleanup' runs without calling v4l2_async_nf_unregister(). The notifier stays registered with the V4L2 subsystem while its underlying device context enters an undefined state. If a camera sensor hot-plug event occurs during this window, the subsystem will attempt to notify through a notifier whose context has been partially torn down. The CVE description calls this an ordering bug, but the real risk is the unregistered-but-not-freed state. The fix (unregister before cleanup) is correct, but the deeper concern is whether other drivers share this same pattern. The V4L2 async notifier API has no compiler-time enforcement of the 'unregister before you clean up' invariant — it's tribal knowledge that lives in commit histories, not in the API itself. For defenders: check your kernel config for CONFIG_STM32_DCMI. The EPSS score of 0.00209 reflects low probability of hardware-triggered probe failure, but note that logical probe failures (memory allocation errors, -EPROBE_DEFER cascades, firmware loading errors) are reproducible without physical reset line manipulation. The attack surface isn't the reset failure — it's any hot-plug event that triggers the notifier while the device context is destabilized. The blast radius extends beyond DCMI: the V4L2 media controller maintains subsystem state about entity bindings and async connections. A notifier firing against a partially-cleaned device corrupts that shared state, affecting every device in the media graph. This isn't a contained local bug — it's a state uncertainty bomb with unknown cascade potential.

Reviewed through automated stages and approved by a human before publication.