CVE-2026-93223

Description

In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix of_node_put() on VIP parse errors tegra_vip_channel_of_parse() initializes np from dev->of_node without taking a reference, but its error paths drop one through the err_node_put label. This underflows the refcount of the VIP device's OF node when endpoint parsing fails on a malformed device tree. The only reference the function takes on np is the success-path of_node_get() stored in vip->chan.of_node, and that one is already released by the tegra_vip_init() error path and by tegra_vip_exit(). Return errors directly instead of jumping to the bogus cleanup label.

Is your site exposed to CVE-2026-93223?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0017

Probability of exploitation

0.06%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/1295ba29ac590bbb5c4a586afd408018168af10b https://git.kernel.org/stable/c/656d047dc0c29c0964d840217a0593f16aa9bc5e https://git.kernel.org/stable/c/7393372f79db940acff206b43e2905685a0c57ad https://git.kernel.org/stable/c/a3783800c9475fa58b8db0885893f96a23f949da https://git.kernel.org/stable/c/fc9937019cf7e2fe4e29f9341e6400bcd2cde721

Frequently Asked Questions

What is CVE-2026-93223? +

In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix of_node_put() on VIP parse errors tegra_vip_channel_of_parse() initializes np from dev->of_node without taking a reference, but its error paths drop one through the err_node_put label. This underflows the refcount of the VIP device's OF node when endpoint parsing fails on a malformed device tree. The only reference the function takes on np is the success-path of_node_get() stored in vip->chan.of_node, and that one is already released by the tegra_vip_init() error path and by tegra_vip_exit(). Return errors directly instead of jumping to the bogus cleanup label.

How do I check if I'm vulnerable to CVE-2026-93223? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.