GHSA-8R39-P738-WGFM
Vulnerability from github – Published: 2026-09-17 18:32 – Updated: 2026-09-17 18:32In the Linux kernel, the following vulnerability has been resolved:
media: stm32: dcmi: fix some error handling bugs in probe()
There are a few issues here:
1) After we assign: chan = dma_request_chan(&pdev->dev, "tx"); Then the error paths need to clean up before returning. The first error path does a direct return. 2) The error paths check "dcmi->mdma_chan" but that is not assigned until later so it results in memory leaks. Test "mdma_chan" instead. 3) The error handling calls dma_release_channel(dcmi->dma_chan) before "dcmi->dma_chan" has been assigned which leads to a NULL pointer dereference. Use the "chan" variable instead.
I also moved the call to dma_release_channel() after the call to dma_release_channel() so it mirrors the allocation code better.
{
"affected": [],
"aliases": [
"CVE-2026-90405"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T17:17:40Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: stm32: dcmi: fix some error handling bugs in probe()\n\nThere are a few issues here:\n\n1) After we assign:\n chan = dma_request_chan(\u0026pdev-\u003edev, \"tx\");\n Then the error paths need to clean up before returning. The first\n error path does a direct return.\n2) The error paths check \"dcmi-\u003emdma_chan\" but that is not assigned\n until later so it results in memory leaks. Test \"mdma_chan\"\n instead.\n3) The error handling calls dma_release_channel(dcmi-\u003edma_chan) before\n \"dcmi-\u003edma_chan\" has been assigned which leads to a NULL pointer\n dereference. Use the \"chan\" variable instead.\n\nI also moved the call to dma_release_channel() after the call to\ndma_release_channel() so it mirrors the allocation code better.",
"id": "GHSA-8r39-p738-wgfm",
"modified": "2026-09-17T18:32:04Z",
"published": "2026-09-17T18:32:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90405"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4d030d7d1af95d24d3eb6e536a4f09b7bf9a8659"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f1d1ed39ced825615aeac61f0b6a322178756632"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.