{"id":"CVE-2026-93223","revision":"cf7697a4cbdc47a1a7da7c66e9f8fc4c","records":[{"revision":"cf7697a4cbdc47a1a7da7c66e9f8fc4c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-93223","aliases":[],"title":"staging: media: tegra-video: fix of_node_put() on VIP parse errors","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: media: tegra-video: fix of_node_put() on VIP parse errors\n\ntegra_vip_channel_of_parse() initializes np from dev->of_node without\ntaking a reference, but its error paths drop one through the\nerr_node_put label. This underflows the refcount of the VIP device's\nOF node when endpoint parsing fails on a malformed device tree.\n\nThe only reference the function takes on np is the success-path\nof_node_get() stored in vip->chan.of_node, and that one is already\nreleased by the tegra_vip_init() error path and by tegra_vip_exit().\n\nReturn errors directly instead of jumping to the bogus cleanup label.","state":0,"publishedAt":"2026-09-24T15:21:06.983+00:00","modifiedAt":"2026-10-19T09:07:34.828+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/staging/media/tegra-video/vip.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e740d199cf0ff1e53ddc2ab067c0a09b55845d68\",\n                            \"lessThan\": \"a3783800c9475fa58b8db0885893f96a23f949da\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e740d199cf0ff1e53ddc2ab067c0a09b55845d68\",\n                            \"lessThan\": \"1295ba29ac590bbb5c4a586afd408018168af10b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e740d199cf0ff1e53ddc2ab067c0a09b55845d68\",\n                            \"lessThan\": \"656d047dc0c29c0964d840217a0593f16aa9bc5e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e740d199cf0ff1e53ddc2ab067c0a09b55845d68\",\n                            \"lessThan\": \"fc9937019cf7e2fe4e29f9341e6400bcd2cde721\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e740d199cf0ff1e53ddc2ab067c0a09b55845d68\",\n                            \"lessThan\": \"7393372f79db940acff206b43e2905685a0c57ad\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/staging/media/tegra-video/vip.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.5\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.109\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.50\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.4\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/a3783800c9475fa58b8db0885893f96a23f949da","https://git.kernel.org/stable/c/1295ba29ac590bbb5c4a586afd408018168af10b","https://git.kernel.org/stable/c/656d047dc0c29c0964d840217a0593f16aa9bc5e","https://git.kernel.org/stable/c/fc9937019cf7e2fe4e29f9341e6400bcd2cde721","https://git.kernel.org/stable/c/7393372f79db940acff206b43e2905685a0c57ad"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-93223","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-93223","identifiers":["CVE-2026-93223"]},"retained":false,"historicalAffected":[]}],"coverage":[]}