CVE-2026-93126: remoteproc: qcom_q6v5_adsp: Fix reference leak for device node
In the Linux kernel, the following vulnerability has been resolved:
remoteproc: qcomq6v5adsp: Fix reference leak for device node
When calling ofparsephandlewithargs(), the caller is responsible to call ofnodeput() to release the reference of device node. In adspmapcarveout, it does not release the reference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
When calling of_parse_phandle_with_args(), ensure the caller invokes of_node_put() to release the reference of the device node (Fix reference leak for device node in remoteproc: qcom_q6v5_adsp).
Linux kernel (remoteproc: qcom_q6v5_adsp) of_node_put() reference handling = Call of_node_put() after of_parse_phandle_with_args() to release the device node reference
Event History
Frequently Asked Questions
What systems are affected by this issue?
The issue is in the Linux kernel's Qualcomm ADSP remoteproc driver, specifically the adsp_map_carveout path. Systems that do not use this driver or code path are not indicated as affected by the provided information.
What does exploitation require?
The provided information identifies a missing of_node_put() call after of_parse_phandle_with_args() obtains a device-node reference. It does not state whether exploitation is remotely triggerable, what privileges are required, or what attacker-controlled input is needed.
What is the available remediation?
Apply a Linux kernel update containing one of the referenced stable commits. The fix releases the device-node reference in adsp_map_carveout.