CVE-2026-93223
Received Received - Intake

Linux Kernel VIP Device Tree Parsing Refcount Underflow

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix of_node_put() on VIP parse errors tegra_vip_channel_of_parse() initializes np from dev->of_node without taking a reference, but its error paths drop one through the err_node_put label. This underflows the refcount of the VIP device's OF node when endpoint parsing fails on a malformed device tree. The only reference the function takes on np is the success-path of_node_get() stored in vip->chan.of_node, and that one is already released by the tegra_vip_init() error path and by tegra_vip_exit(). Return errors directly instead of jumping to the bogus cleanup label.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93223
EUVD
EUVD-2026-86226

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's staging media driver for Tegra video devices. It involves improper handling of a device tree node reference in the tegra_vip_channel_of_parse() function. When parsing fails due to a malformed device tree, the function incorrectly drops a reference count on the VIP device's OF node, leading to an underflow. This happens because the function initializes a node pointer without taking a reference but attempts to release one in error paths.

Detection Guidance

This vulnerability is specific to the Linux kernel's tegra-video driver and relates to improper reference counting in device tree parsing. Detection requires checking kernel logs for errors related to tegra_vip_channel_of_parse() or malformed device tree entries for VIP devices. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could cause system instability or crashes in systems using the Tegra video driver with a malformed device tree. It may lead to unexpected behavior or denial of service if the reference count underflow corrupts memory management in the kernel.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel memory management issue related to device tree parsing in the tegra-video subsystem, which could lead to undefined behavior but does not involve data exposure or privacy violations typical of compliance concerns.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Monitor kernel logs for VIP-related errors after updating. If using a custom kernel, ensure tegra_vip_channel_of_parse() properly handles reference counting in error paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93223. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart