{"id":"CVE-2026-93223","summary":"staging: media: tegra-video: fix of_node_put() on VIP parse errors","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: media: tegra-video: fix of_node_put() on VIP parse errors\n\ntegra_vip_channel_of_parse() initializes np from dev-\u003eof_node without\ntaking a reference, but its error paths drop one through the\nerr_node_put label. This underflows the refcount of the VIP device's\nOF node when endpoint parsing fails on a malformed device tree.\n\nThe only reference the function takes on np is the success-path\nof_node_get() stored in vip-\u003echan.of_node, and that one is already\nreleased by the tegra_vip_init() error path and by tegra_vip_exit().\n\nReturn errors directly instead of jumping to the bogus cleanup label.","modified":"2026-09-25T03:48:53.943318702Z","published":"2026-09-24T15:21:06.983Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93223.json"},"references":[{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1295ba29ac590bbb5c4a586afd408018168af10b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/656d047dc0c29c0964d840217a0593f16aa9bc5e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7393372f79db940acff206b43e2905685a0c57ad"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a3783800c9475fa58b8db0885893f96a23f949da"},{"type":"WEB","url":"https://git.kernel.org/stable/c/fc9937019cf7e2fe4e29f9341e6400bcd2cde721"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93223.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93223"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"e740d199cf0ff1e53ddc2ab067c0a09b55845d68"},{"fixed":"a3783800c9475fa58b8db0885893f96a23f949da"},{"fixed":"1295ba29ac590bbb5c4a586afd408018168af10b"},{"fixed":"656d047dc0c29c0964d840217a0593f16aa9bc5e"},{"fixed":"fc9937019cf7e2fe4e29f9341e6400bcd2cde721"},{"fixed":"7393372f79db940acff206b43e2905685a0c57ad"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93223.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.0"},{"fixed":"6.6.157"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.109"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.50"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93223.json"}}],"schema_version":"1.9.0"}