UBUNTU-CVE-2026-93223: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix ofnodeput() on VIP parse errors tegravipchannelofparse() initializes np from dev->ofnode without taking a reference, but its error paths drop one through the errnodeput label. This underflows the refcount of the VIP device's OF node when endpoint parsing fails on a malformed device tree. The only reference the function takes on np is the success-path ofnodeget() stored in vip->chan.ofnode, and that one is already released by the tegravipinit() error path and by tegravipexit(). Return errors directly instead of jumping to the bogus cleanup label.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
The affected code is in the Tegra VIP staging media driver. Exposure requires a system using that driver with a device-tree configuration that causes endpoint parsing to fail; the listed Ubuntu kernel packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
What is required to trigger the vulnerability?
A malformed device tree must cause endpoint parsing in tegra_vip_channel_of_parse() to fail. On that error path, the driver incorrectly drops a reference to the VIP device's OF node even though it did not acquire that reference.
Are default configurations known to be affected?
The available information does not establish that a default configuration is affected. The faulty path is specifically tied to endpoint parsing errors caused by a malformed device tree.
How can I determine whether a system may be affected?
Check whether the system runs one of the listed Ubuntu kernel packages and uses the Tegra VIP staging media driver. Systems without that driver or without a malformed device-tree endpoint configuration are not described as reaching the vulnerable error path.