CVE-2026-93193 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
drm/rockchip: analogix_dp: Fix OF node reference leak via auto cleanup
Sashiko reported a reference leak in rockchip_dp_drm_encoder_enable(), the of_get_child_by_name() function does not call of_node_put() in a symmetrical way [1].
Fix the device node reference leak by using __free(device_node) to automatically manage of_node_put() for all device nodes.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel's DRM subsystem, specifically within the Rockchip display driver and its interaction with the analogix DP bridge component, contained a resource management flaw that resulted in an operating system-level reference leak. This vulnerability was identified by Sashiko and addressed through code modifications aimed at correcting improper handling of device tree node references during encoder initialization sequences. The core technical issue resides within the rockchip_dp_drm_encoder_enable function, which is responsible for enabling the display encoder hardware. During this process, the driver invokes the of_get_child_by_name API to retrieve a pointer to a specific child node from the device tree structure associated with the Rockchip SoC's display controller. This API increments the reference count of the returned struct device_node object to ensure it remains valid while in use by the kernel subsystems.
The fundamental flaw was that the code path failed to call of_node_put() in a symmetrical manner after obtaining the node pointer. In Linux kernel programming, every successful acquisition of a device tree node via functions like of_get_child_by_name requires a corresponding release operation to decrement the reference count and prevent memory leaks or resource exhaustion over time. Without this cleanup step, each invocation of the encoder enable routine would leave an unreleased reference in the system's internal data structures. While a single leak might appear negligible, repeated executions during display mode changes or hot-plug events could accumulate these leaked references, potentially leading to increased kernel memory consumption and eventual resource depletion that impacts system stability.
The remediation strategy employed by the maintainers leverages C11-style cleanup attributes available in modern Linux kernel development practices. By annotating the device node pointer variable with __free(device_node), the code ensures that when the function scope exits, whether through normal completion or early return due to an error condition, the compiler-generated destructor automatically invokes of_node_put(). This approach eliminates human error associated with manual reference counting and guarantees consistent cleanup across all execution paths. It represents a shift toward more robust resource management patterns that reduce the likelihood of similar bugs in adjacent code sections dealing with device tree interactions.
From a classification perspective, this vulnerability aligns with CWE-401, which describes a missing release of memory after effective usage or failure to free allocated resources. The improper handling of kernel object references is a classic example of resource management errors that can degrade system performance over extended periods rather than causing immediate catastrophic failures. In the context of the MITRE ATT&CK framework for enterprise security, this type of issue does not typically represent an exploitable attack vector in itself but falls under broader categories related to software quality and maintainability issues such as T1496 or general configuration errors that could indirectly affect availability if left unpatched.
The operational impact of leaving this vulnerability unresolved is primarily centered on system reliability rather than direct security compromise like privilege escalation or data exfiltration. Over time, the accumulation of leaked device node references contributes to kernel memory fragmentation and increased baseline memory usage. In embedded systems where Rockchip SoCs are commonly deployed, such as digital signage, industrial controllers, or consumer electronics, consistent resource leaks can lead to gradual performance degradation. Eventually, this may trigger out-of-memory conditions within critical subsystems, causing display artifacts, driver crashes, or requiring system reboots to restore normal functionality.
Mitigation for this issue involves applying the upstream kernel patch that implements the automatic cleanup mechanism via __free(device_node). System administrators and embedded developers should ensure their kernels are updated to versions containing this fix. For organizations maintaining custom builds of the Linux kernel, it is essential to verify that all DRM drivers interacting with device trees adhere to strict reference counting protocols or utilize modern auto-cleanup attributes where supported by the compiler toolchain. Regular auditing of driver code for symmetrical acquire-release patterns remains a best practice to prevent recurrence of similar resource management defects in other subsystems beyond just display controllers.