CVE-2026-90405: media: stm32: dcmi: fix some error handling bugs in probe()
In the Linux kernel, the following vulnerability has been resolved:
media: stm32: dcmi: fix some error handling bugs in probe()
There are a few issues here:
1) After we assign: chan = dmarequestchan(&pdev->dev, "tx"); Then the error paths need to clean up before returning. The first error path does a direct return. 2) The error paths check "dcmi->mdmachan" but that is not assigned until later so it results in memory leaks. Test "mdmachan" instead. 3) The error handling calls dmareleasechannel(dcmi->dmachan) before "dcmi->dmachan" has been assigned which leads to a NULL pointer dereference. Use the "chan" variable instead.
I also moved the call to dmareleasechannel() after the call to dmareleasechannel() so it mirrors the allocation code better.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel STM32 DCMI driver are affected when the driver’s probe routine reaches an error path after requesting the "tx" DMA channel.
What can happen if the affected error paths are triggered?
The paths can leak DMA channel resources because they test an unassigned MDMA channel field. They can also dereference a NULL DMA channel pointer when releasing a channel before the driver field has been assigned.