CVE-2026-89872: media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link
In the Linux kernel, the following vulnerability has been resolved:
media: v4l2-fwnode: Fix fwnode leak in v4l2fwnodeparselink
In v4l2fwnodeparselink(), the remote endpoint fwnode reference is acquired using fwnodegraphgetremoteendpoint(). This reference is properly released in the error paths, but it is leaked on the success path.
Add the missing fwnodehandleput() before returning 0 to prevent the reference leak.
[Sakari Ailus: Fix subject prefix and coding style a little.]
Affected Software
Event History
Frequently Asked Questions
What condition triggers the leak?
The leak occurs when v4l2_fwnode_parse_link() successfully parses a link after acquiring a remote endpoint fwnode reference with fwnode_graph_get_remote_endpoint(). Error paths already release the reference; the missing release was only on the success path.
How can the issue be corrected?
The fix adds fwnode_handle_put() before v4l2_fwnode_parse_link() returns success, releasing the remote endpoint fwnode reference. The provided stable-kernel references identify commits containing the correction.