{"cve":"CVE-2026-90405","nvd":{"published":"2026-09-17T17:17:40.357","modified":"2026-10-19T09:19:34.683","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: stm32: dcmi: fix some error handling bugs in probe()\n\nThere are a few issues here:\n\n1) After we assign:\n        chan = dma_request_chan(&pdev->dev, \"tx\");\n   Then the error paths need to clean up before returning.  The first\n   error path does a direct return.\n2) The error paths check \"dcmi->mdma_chan\" but that is not assigned\n   until later so it results in memory leaks.  Test \"mdma_chan\"\n   instead.\n3) The error handling calls dma_release_channel(dcmi->dma_chan) before\n   \"dcmi->dma_chan\" has been assigned which leads to a NULL pointer\n   dereference.  Use the \"chan\" variable instead.\n\nI also moved the call to dma_release_channel() after the call to\ndma_release_channel() so it mirrors the allocation code better.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/4d030d7d1af95d24d3eb6e536a4f09b7bf9a8659","https://git.kernel.org/stable/c/f1d1ed39ced825615aeac61f0b6a322178756632"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-90405","score":0.00198,"percentile":0.0943,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}