Executive brief
The Linux kernel's STM32 DCMI camera interface driver contains error handling bugs in its initialization code that can cause memory leaks and null pointer crashes when DMA channel setup fails. An attacker with the ability to trigger DMA allocation failures or a user with a misconfigured system could cause a kernel panic or resource exhaustion.
Technical details
The vulnerability is a series of error handling defects in the dcmi_probe() function of drivers/media/platform/st/stm32/stm32-dcmi.c. The issues include: (1) missing cleanup of DMA channels in one error path that directly returns instead of jumping to cleanup handlers; (2) checking an uninitialized struct member (dcmi->mdma_chan) instead of the local variable (mdma_chan) in error handlers, causing memory leaks; and (3) attempting to release a DMA channel (dcmi->dma_chan) before it has been assigned, leading to a null pointer dereference. These bugs occur during device probe/initialization, which runs with elevated privileges. The patch reorganizes error handling to use proper goto-based cleanup that mirrors the allocation order and checks the correct variables.
Affected products
- Linux Linux kernel affected versions prior to fix commit f1d1ed39ced825615aeac61f0b6a322178756632
Timeline
- 2026-09-17: disclosed
- 2026-07-30: patched: Upstream commit f1d1ed39ced825615aeac61f0b6a322178756632