The STM32 DCMI driver registers an asynchronous notifier before pulling the hardware reset line. If the reset operation fails, the probe routine returns via an error path without invoking the driver's remove function, leaving the notifier registered. This missing release violates the V4L2 async notifier lifetime rules and creates a resource leak that may result in undefined kernel behavior or instability.

Any Linux kernel containing the STM32 DCMI media driver prior to the commit that removes the notifier during probe failure. The advisory does not list explicit kernel versions, so all builds that include the unpatched driver are potentially affected.

The vulnerability scores 7.8 for CVSS, indicating significant impact. The EPSS score is below 1 %, pointing to a low probability of exploitation at present. The issue is not listed in the CISA KEV catalog, and no public exploitation is known. The likely attack vector is driver initialization when a reset failure triggers the error path, leading to an unreleased notifier. While no direct privilege escalation or remote code execution path is described, the consequence is the risk of kernel-level instability.