Linux Kernel EUVD-2026-55311

The Linux kernel driver at drivers/media/platform/st/stm32/stm32-dcmi.c implements the STM32 Digital Camera Memory Interface, a video capture peripheral found in STMicroelectronics STM32 SoCs used in embedded and industrial systems. The V4L2 async notifier framework (v4l2_async_nf_register / v4l2_async_nf_unregister) allows camera drivers to register callbacks that fire asynchronously when subordinate devices such as image sensors become available. During dcmi_probe(), dcmi_graph_init() registers the notifier via v4l2_async_nf_register(), but if the immediately subsequent reset_control_assert() or reset_control_deassert() call fails, the function returns via err_cleanup without invoking v4l2_async_nf_unregister(). Because the driver core does not call dcmi_remove() on probe failure, the dangling notifier remains registered and can fire against freed or reused kernel memory - a classic use-after-free scenario arising from asymmetric error-path teardown. NVD did not assign a CWE, but the root cause maps to CWE-459 (Incomplete Cleanup) and CWE-416 (Use After Free). The vulnerability was introduced by commit d079f94c90469f413920b9f2b201537fac2ceb06 and is restricted to the stm32-dcmi module.