CVE-2026-93223
In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix of_node_put() on VIP parse errors tegra_vip_channel_of_parse() initializes np from dev->of_node without taking a reference, but its error paths drop one through the err_node_put label. This underflows the refcount of the VIP device's OF node when endpoint parsing fails on a malformed device tree. The only reference the function takes on np is the success-path of_node_get() stored in vip->chan.of_node, and that one is already released by the tegra_vip_init() error path and by tegra_vip_exit(). Return errors directly instead of jumping to the bogus cleanup label.
Affected versions
Linux kernel versions
6.5
and later are affected. Fixed in
6.6.157,
6.12.109,
6.18.50,
7.2.4,
7.3-rc1
and their respective stable series.
References
5 totalFrequently asked questions
-
What is CVE-2026-93223?
CVE-2026-93223 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.5 onward and has been patched in 6.6.157, 6.12.109, 6.18.50 and others. CVE-2026-93223 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-93223?
Yes. CVE-2026-93223 has been patched. Fixed versions include 6.6.157, 6.12.109, 6.18.50 and others. If you are running Linux kernel 6.5 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-93223 actively exploited?
No. CVE-2026-93223 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.