CVE-2026-93143: staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

staging: media: ipu7: fix pmruntime refcount leak in ipu7resume()

ipu7resume() calls pmruntimegetsync() before resuming the device. If the runtime PM resume fails, the usage count remains incremented, but the error path returns without dropping the reference.

Use pmruntimeresumeandget() instead, which balances the usage count on failure and avoids the leak. Keep returning 0 on error, as resume callbacks should not propagate failures to the PM core, matching the behaviour of the ipu6 driver.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Apply the resolved fix for staging media ipu7: keep returning 0 on error (callbacks should not propagate failures to the PM core), and use pm_runtime_resume_and_get() to balance the usage count; ensure the ipu7_resume() error path returns without dropping the reference to avoid the pm_runtime refcount leak.

    Linux kernel (staging: media: ipu7) pm_runtime_resume callback error handling = Return 0 on error (do not propagate failures to the PM core); use pm_runtime_resume_and_get() instead of returning error behavior that leaks refcount

Event History

Sep 17, 2026
CVE Published
via MITRE·04:11 PM
Data Sourced
via MITRE·04:11 PM
Description

Frequently Asked Questions

1

Which systems are exposed to this issue?

Systems using the Linux kernel IPU7 staging media driver are affected when ipu7_resume() is invoked and the runtime PM resume operation fails. The provided data does not identify specific kernel versions or hardware platforms.

2

What condition triggers the reference leak?

The leak occurs when ipu7_resume() calls pm_runtime_get_sync() and the runtime PM resume fails. In that failure path, the runtime PM usage count remains incremented because the acquired reference is not dropped.

3

What is the remediation?

Apply the referenced Linux kernel fixes, which replace pm_runtime_get_sync() with pm_runtime_resume_and_get() in ipu7_resume(). The replacement balances the runtime PM usage count when resume fails while preserving the callback's behavior of returning 0 on error.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203