CVE-2026-93223: staging: media: tegra-video: fix of_node_put() on VIP parse errors
In the Linux kernel, the following vulnerability has been resolved:
staging: media: tegra-video: fix ofnodeput() on VIP parse errors
tegravipchannelofparse() initializes np from dev->ofnode without taking a reference, but its error paths drop one through the errnodeput label. This underflows the refcount of the VIP device's OF node when endpoint parsing fails on a malformed device tree.
The only reference the function takes on np is the success-path ofnodeget() stored in vip->chan.ofnode, and that one is already released by the tegravipinit() error path and by tegravipexit().
Return errors directly instead of jumping to the bogus cleanup label.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.157 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.109 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.50 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.4
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
Endpoint parsing in tegra_vip_channel_of_parse() must fail while processing a malformed device tree. The erroneous cleanup path then drops a reference to the VIP device's OF node even though the function did not acquire that reference.
What component or configuration is exposed?
The issue is in the Linux kernel staging media Tegra VIP video driver. Exposure depends on use of that driver together with a malformed device-tree endpoint configuration; the provided data does not establish that a default configuration is affected.
What is the relevant mitigation if an update cannot be applied immediately?
Avoid deploying malformed device trees that cause VIP endpoint parsing failures. In particular, review the device-tree endpoint configuration used by the Tegra VIP driver.