CVE-2026-93223 staging: media: tegra-video: fix of_node_put() on VIP parse errors
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-93223?
CVE-2026-93223 is a vulnerability in Linux, published on 24 Sep 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
staging: media: tegra-video: fix of_node_put() on VIP parse errors
tegra_vip_channel_of_parse() initializes np from dev->of_node without taking a reference, but its error paths drop one through the err_node_put label. This underflows the refcount of the VIP device's OF node when endpoint parsing fails on a malformed device tree.
The only reference the function takes on np is the success-path of_node_get() stored in vip->chan.of_node, and that one is already released by the tegra_vip_init() error path and by tegra_vip_exit().
Return errors directly instead of jumping to the bogus cleanup label.
Which versions are affected by CVE-2026-93223?
How do I fix CVE-2026-93223?
Upgrade to a fixed version.
Is CVE-2026-93223 being exploited?
There is no known exploitation of CVE-2026-93223 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-93223, DEBIAN-CVE-2026-93223, GHSA-f6j6-qc9x-24h7, UBUNTU-CVE-2026-93223.