CVE-2026-93223

Summary

In the Linux kernel, the following vulnerability has been resolved:

staging: media: tegra-video: fix of_node_put() on VIP parse errors

tegra_vip_channel_of_parse() initializes np from dev->of_node without taking a reference, but its error paths drop one through the err_node_put label. This underflows the refcount of the VIP device's OF node when endpoint parsing fails on a malformed device tree.

The only reference the function takes on np is the success-path of_node_get() stored in vip->chan.of_node, and that one is already released by the tegra_vip_init() error path and by tegra_vip_exit().

Return errors directly instead of jumping to the bogus cleanup label.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxe740d199cf0ff1e53ddc2ab067c0a09b55845d68 < a3783800c9475fa58b8db0885893f96a23f949daaffected
LinuxLinuxe740d199cf0ff1e53ddc2ab067c0a09b55845d68 < 1295ba29ac590bbb5c4a586afd408018168af10baffected
LinuxLinuxe740d199cf0ff1e53ddc2ab067c0a09b55845d68 < 656d047dc0c29c0964d840217a0593f16aa9bc5eaffected
LinuxLinuxe740d199cf0ff1e53ddc2ab067c0a09b55845d68 < fc9937019cf7e2fe4e29f9341e6400bcd2cde721affected
LinuxLinuxe740d199cf0ff1e53ddc2ab067c0a09b55845d68 < 7393372f79db940acff206b43e2905685a0c57adaffected
LinuxLinux6.5affected
LinuxLinux0 < 6.5unaffected
LinuxLinux6.6.157 <= 6.6.*unaffected
LinuxLinux6.12.109 <= 6.12.*unaffected
LinuxLinux6.18.50 <= 6.18.*unaffected
LinuxLinux7.2.4 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References