In the Linux kernel’s media driver for STM32 DCMI, the asynchronous notifier is registered before the hardware reset line is toggled. If resetting the device fails, the probe routine returns through an error cleanup path and the kernel does not invoke the corresponding remove function. Because the notifier remains registered, the kernel may later attempt to notify a driver that has not been properly removed, violating the V4L2 async notifier lifetime rules and potentially causing undefined kernel behavior or instability. No data in the description suggests the vulnerability can be leveraged for code execution or privilege escalation, but the improper resource cleanup could disrupt device operation or lead to a kernel panic in extreme cases.

The issue affects Linux kernels that include the STM32 DCMI media driver as shipped before the fix. The exact kernel versions are not listed, so any install that has the driver present without the applied patch is potentially affected.

The CVSS score is not provided and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog, and there is no public evidence of an ongoing exploit. Because the bug manifests during driver initialization and does not provide an information disclosure or execution vector, the practical risk level is low, though the driver might fail to load or behave unpredictably on failure of the reset sequence.