VulnerabilityPublished 24 Sep 2026Updated 19 Oct 2026

CVE-2026-93223: Linux kernel · staging: media: tegra-video: fix of_node_put() on VIP parse errors

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in fc9937019cf7e2fe4e29f9341e6400bcd2cde721 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in fc9937019cf7e2fe4e29f9341e6400bcd2cde721, a3783800c9475fa58b8db0885893f96a23f949da, 7393372f79db940acff206b43e2905685a0c57ad +2

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ e740d199cf0ff1e53ddc2ab067c0a09b55845d68, < fc9937019cf7e2fe4e29f9341e6400bcd2cde721	Fixed in fc9937019cf7e2fe4e29f9341e6400bcd2cde721
LinuxLinux	Affected ≥ e740d199cf0ff1e53ddc2ab067c0a09b55845d68, < a3783800c9475fa58b8db0885893f96a23f949da	Fixed in a3783800c9475fa58b8db0885893f96a23f949da
LinuxLinux	Affected ≥ e740d199cf0ff1e53ddc2ab067c0a09b55845d68, < 7393372f79db940acff206b43e2905685a0c57ad	Fixed in 7393372f79db940acff206b43e2905685a0c57ad
LinuxLinux	Affected ≥ e740d199cf0ff1e53ddc2ab067c0a09b55845d68, < 1295ba29ac590bbb5c4a586afd408018168af10b	Fixed in 1295ba29ac590bbb5c4a586afd408018168af10b
LinuxLinux	Affected ≥ e740d199cf0ff1e53ddc2ab067c0a09b55845d68, < 656d047dc0c29c0964d840217a0593f16aa9bc5e	Fixed in 656d047dc0c29c0964d840217a0593f16aa9bc5e
LinuxLinux	Affected =6.5	Fixed in–

AI-suggested

A fix is available and has been applied in the Linux kernel source. Users should update to the fixed kernel versions containing the referenced commits to remediate this issue.

Description

A reference count underflow vulnerability was fixed in the Linux kernel's tegra-video driver. The issue occurred during device tree parsing when an error path incorrectly decremented a reference count, potentially leading to resource management errors. The fix changes error handling to avoid improper cleanup calls.

Impact

The vulnerability causes an underflow of the reference count for the VIP device's Open Firmware node during device tree parsing errors. While the direct security impact is not detailed, reference count underflows can lead to use-after-free or memory corruption issues, potentially destabilizing the kernel or enabling further exploitation. No known exploits in the wild are reported.

Summary

CVE-2026-93223 addresses a flaw in the Linux kernel's tegra-video staging driver where tegra_vip_channel_of_parse() initializes a device node pointer without taking a reference, but on parse errors, erroneously decrements the reference count via the err_node_put label. This causes an underflow of the VIP device's OF node reference count when endpoint parsing fails on malformed device trees. The vulnerability is fixed by returning errors directly instead of jumping to the incorrect cleanup label, preventing the reference count underflow.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 14:00 UTC

Technical details

References

Community reviews

Related threats