CVE-2026-93223
Description
In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix of_node_put() on VIP parse errors tegra_vip_channel_of_parse() initializes np from dev->of_node without taking a reference, but its error paths drop one through the err_node_put label. This underflows the refcount of the VIP device's OF node when endpoint parsing fails on a malformed device tree. The only reference the function takes on np is the success-path of_node_get() stored in vip->chan.of_node, and that one is already released by the tegra_vip_init() error path and by tegra_vip_exit(). Return errors directly instead of jumping to the bogus cleanup label.
How to fix
- Linux Linuxa3783800c9475fa58b8db0885893f96a23f949da, 1295ba29ac590bbb5c4a586afd408018168af10b, 656d047dc0c29c0964d840217a0593f16aa9bc5e, fc9937019cf7e2fe4e29f9341e6400bcd2cde721, 7393372f79db940acff206b43e2905685a0c57ad or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | e740d199cf0ff1e53ddc2ab067c0a09b55845d68 ≤ v < a3783800c9475fa58b8db0885893f96a23f949da, e740d199cf0ff1e53ddc2ab067c0a09b55845d68 ≤ v < 1295ba29ac590bbb5c4a586afd408018168af10b, e740d199cf0ff1e53ddc2ab067c0a09b55845d68 ≤ v < 656d047dc0c29c0964d840217a0593f16aa9bc5e, e740d199cf0ff1e53ddc2ab067c0a09b55845d68 ≤ v < fc9937019cf7e2fe4e29f9341e6400bcd2cde721, e740d199cf0ff1e53ddc2ab067c0a09b55845d68 ≤ v < 7393372f79db940acff206b43e2905685a0c57ad, 6.5 | a3783800c9475fa58b8db0885893f96a23f949da, 1295ba29ac590bbb5c4a586afd408018168af10b, 656d047dc0c29c0964d840217a0593f16aa9bc5e, fc9937019cf7e2fe4e29f9341e6400bcd2cde721, 7393372f79db940acff206b43e2905685a0c57ad |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.