CVE-2026-93223 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
staging: media: tegra-video: fix of_node_put() on VIP parse errors
tegra_vip_channel_of_parse() initializes np from dev->of_node without taking a reference, but its error paths drop one through the err_node_put label. This underflows the refcount of the VIP device's OF node when endpoint parsing fails on a malformed device tree.
The only reference the function takes on np is the success-path of_node_get() stored in vip->chan.of_node, and that one is already released by the tegra_vip_init() error path and by tegra_vip_exit().
Return errors directly instead of jumping to the bogus cleanup label.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified within the Linux kernel staging driver for NVIDIA Tegra Video Processing Unit involves a reference counting imbalance in the device tree parsing logic, specifically within the tegra_vip_channel_of_parse function. This issue stems from an incorrect handling of the struct device_node pointer during error conditions when processing hardware endpoints defined in the device tree. The core technical flaw lies in the initialization and subsequent cleanup of this node pointer. When the function begins execution, it retrieves a reference to the parent device's OF node via dev->of_node without explicitly incrementing its internal reference count using of_node_get. However, upon encountering any error during the parsing of endpoints, the code path jumps to an err_node_put label which subsequently calls of_node_put on that same pointer. Because no additional reference was acquired at the start for this specific scope, invoking a release operation results in decrementing a reference count that does not belong to the current execution context's ownership set, leading to an underflow of the refcount associated with the VIP device's OF node structure.
This reference counting error manifests as a use-after-free or double-free scenario depending on how the kernel memory allocator manages the freed object if the counter reaches zero prematurely. In Linux kernel development, every call to of_node_get must have a corresponding and balanced call to of_node_put by the same logical owner to prevent such integrity violations. The existing code incorrectly assumes that the reference obtained from dev->of_node is owned locally for the duration of the parsing routine, whereas it remains tied to the lifetime of the parent device structure itself. Consequently, when endpoint parsing fails due to a malformed or incomplete device tree configuration, the erroneous cleanup path triggers an underflow. This can corrupt internal kernel data structures related to device nodes, potentially leading to system instability, crashes, or in worst-case scenarios, exploitation vectors where attackers might leverage memory corruption primitives to gain unauthorized access or execute arbitrary code within the kernel space.
The operational impact of this vulnerability is primarily centered around stability and reliability during hardware initialization phases. If a system boots with a malformed device tree for Tegra-based SoCs, the driver may crash immediately upon loading due to the refcount underflow triggering kernel warnings or panics. Even if the immediate crash does not occur, the corrupted reference count can lead to premature freeing of critical device node structures while they are still being accessed by other parts of the subsystem that rely on their validity. This creates a race condition window where subsequent operations might dereference freed memory, resulting in unpredictable behavior and potential denial of service conditions for media pipeline functionality. The vulnerability is particularly relevant in embedded environments using Tegra hardware where device tree configurations can vary significantly based on board revisions or custom modifications.
To mitigate this issue, the recommended approach involves correcting the control flow within the parsing function to ensure that cleanup operations only occur when they are logically appropriate and do not interfere with parent-owned references. The fix entails returning error codes directly from the points of failure rather than jumping to a shared error handling label that performs invalid cleanup actions. By bypassing the bogus err_node_put path, the driver avoids decrementing the reference count for the node it does not own. This aligns with standard kernel coding practices where ownership semantics are strictly maintained. Furthermore, developers should ensure that any local references acquired during parsing are properly managed and released only when they go out of scope or upon successful initialization completion via tegra_vip_init error paths which already handle cleanup correctly.
From a classification perspective, this vulnerability maps to CWE-416: Use After Free, as the underlying mechanism involves manipulating reference counts in a way that can lead to accessing freed memory if the underflow causes premature deallocation. It also relates to CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, given that refcount corruption affects shared kernel data structures accessible by multiple drivers and subsystems. In terms of MITRE ATT&CK techniques, this falls under T1059: Command and Scripting Interpreter if exploited for initial access via malformed device tree injection in virtualized or containerized environments, though more accurately it represents a flaw that enables privilege escalation through memory corruption primitives like those described in T1203: Exploitation for Client Execution. Addressing this requires strict adherence to reference counting protocols within the Linux kernel subsystems and rigorous testing of driver initialization paths against malformed hardware descriptions.