CVE-2026-93143 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()
ipu7_resume() calls pm_runtime_get_sync() before resuming the device. If the runtime PM resume fails, the usage count remains incremented, but the error path returns without dropping the reference.
Use pm_runtime_resume_and_get() instead, which balances the usage count on failure and avoids the leak. Keep returning 0 on error, as resume callbacks should not propagate failures to the PM core, matching the behaviour of the ipu6 driver.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the Linux kernel staging media subsystem involves a reference counting imbalance within the power management routines for the Intel IPU7 camera interface driver. Specifically, the issue resides in the ipu7_resume function, which is responsible for restoring device state after a system sleep cycle. The original implementation utilized pm_runtime_get_sync to ensure the device was powered on before proceeding with resume operations. This API increments the runtime power management usage count upon successful invocation and also attempts to wake the device if it was suspended. However, the code failed to handle the scenario where this operation returns an error code indicating that the hardware could not be successfully resumed or is otherwise unavailable for operation.
When pm_runtime_get_sync fails due to a hardware fault, timeout, or other transient power management issues, the usage count remains incremented because the function has already performed the increment before determining success or failure. The existing error handling path in ipu7_resume simply returned this negative error code without calling pm_runtime_put to decrement the reference counter. This oversight results in a persistent leak of runtime PM references every time the resume operation fails. Over time, particularly during repeated suspend-resume cycles where failures occur, these leaked references accumulate, causing the device's usage count to grow indefinitely until it potentially reaches its maximum limit or causes broader system instability by preventing the power management core from correctly managing device states.
This type of flaw is classified under CWE-401, which describes a missing release of resource after effective use, specifically manifesting here as a reference leak in kernel space. From an operational perspective, while this may not immediately lead to a denial of service or privilege escalation for external attackers, it degrades system reliability and can mask deeper hardware initialization issues. It violates the principle that power management callbacks must maintain strict symmetry between get and put operations regardless of success or failure outcomes within their specific scope. The fix involves replacing pm_runtime_get_sync with pm_runtime_resume_and_get, a helper function designed explicitly to handle this pattern by automatically balancing the usage count on both success and failure paths.
Furthermore, the remediation includes adjusting the return behavior of the resume callback. Instead of propagating the error code from the power management operation back to the core PM framework, the driver now returns zero even if the resume fails. This aligns with best practices for runtime PM callbacks, which generally should not propagate failures up the stack as it can interfere with higher-level suspend and resume logic that expects devices to be in a consistent state or handles errors at a different abstraction layer. This approach mirrors the established behavior of the ipu6 driver, ensuring consistency across Intel IPU drivers within the kernel staging tree.
From an ATT&CK perspective, this vulnerability does not directly map to a specific attack technique as it is primarily a reliability and resource management issue rather than a direct exploitation vector for unauthorized access or execution. However, persistent reference leaks can contribute to system instability which might be leveraged in broader denial-of-service scenarios if the attacker can trigger repeated resume failures. The mitigation relies on correct API usage within kernel development practices, emphasizing the importance of using helper functions that encapsulate complex power management state transitions safely. Developers must ensure that all paths through device lifecycle callbacks properly balance reference counts to maintain system integrity and prevent resource exhaustion over long uptimes or frequent power cycling events.