CVE-2026-93143: staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()
In the Linux kernel, the following vulnerability has been resolved:
staging: media: ipu7: fix pmruntime refcount leak in ipu7resume()
ipu7resume() calls pmruntimegetsync() before resuming the device. If the runtime PM resume fails, the usage count remains incremented, but the error path returns without dropping the reference.
Use pmruntimeresumeandget() instead, which balances the usage count on failure and avoids the leak. Keep returning 0 on error, as resume callbacks should not propagate failures to the PM core, matching the behaviour of the ipu6 driver.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the resolved fix for staging media ipu7: keep returning 0 on error (callbacks should not propagate failures to the PM core), and use pm_runtime_resume_and_get() to balance the usage count; ensure the ipu7_resume() error path returns without dropping the reference to avoid the pm_runtime refcount leak.
Linux kernel (staging: media: ipu7) pm_runtime_resume callback error handling = Return 0 on error (do not propagate failures to the PM core); use pm_runtime_resume_and_get() instead of returning error behavior that leaks refcount
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel IPU7 staging media driver are affected when ipu7_resume() is invoked and the runtime PM resume operation fails. The provided data does not identify specific kernel versions or hardware platforms.
What condition triggers the reference leak?
The leak occurs when ipu7_resume() calls pm_runtime_get_sync() and the runtime PM resume fails. In that failure path, the runtime PM usage count remains incremented because the acquired reference is not dropped.
What is the remediation?
Apply the referenced Linux kernel fixes, which replace pm_runtime_get_sync() with pm_runtime_resume_and_get() in ipu7_resume(). The replacement balances the runtime PM usage count when resume fails while preserving the callback's behavior of returning 0 on error.