CVE-2026-93223

Description

In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix of_node_put() on VIP parse errors tegra_vip_channel_of_parse() initializes np from dev->of_node without taking a reference, but its error paths drop one through the err_node_put label. This underflows the refcount of the VIP device's OF node when endpoint parsing fails on a malformed device tree. The only reference the function takes on np is the success-path of_node_get() stored in vip->chan.of_node, and that one is already released by the tegra_vip_init() error path and by tegra_vip_exit(). Return errors directly instead of jumping to the bogus cleanup label.

Overview

State: PUBLISHED
Assigner (CNA): Linux
CVSS severity: —
CVSS score: —
CVSS vector: —
Effective score: no score available from CNA, NVD, or AI yet
CWE(s): —
Reserved: 2026-09-17
Published: 2026-09-24 15:21 UTC
Last updated: 2026-09-24 15:21 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93223.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-24 16:17:17 UTC
NVD last modified: 2026-09-24 16:17:17 UTC

AI-forensic CVSS estimate

Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.

No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-86226
Assigner: Linux
Published: Sep 24, 2026, 3:21:06 PM
Updated: Sep 24, 2026, 3:21:06 PM
EUVD base score: 0.0 / 10
EUVD-reported EPSS: 0.0000
Vendors: Linux
Products: Linux (patch: 7.2.4)

Linux (patch: 6.6.157)

Linux (patch: 6.18.50)

Linux (e740d199cf0ff1e53ddc2ab067c0a09b55845d68 <1295ba29ac590bbb5c4a586afd408018168af10b)

Linux (patch: 6.12.109)

Linux (e740d199cf0ff1e53ddc2ab067c0a09b55845d68 <7393372f79db940acff206b43e2905685a0c57ad)

Linux (e740d199cf0ff1e53ddc2ab067c0a09b55845d68 <656d047dc0c29c0964d840217a0593f16aa9bc5e)

Linux (6.5)

Linux (patch: 0)

Linux (patch: 7.3-rc1)

Linux (e740d199cf0ff1e53ddc2ab067c0a09b55845d68 <a3783800c9475fa58b8db0885893f96a23f949da)

Linux (e740d199cf0ff1e53ddc2ab067c0a09b55845d68 <fc9937019cf7e2fe4e29f9341e6400bcd2cde721)
Aliases: GHSA-f6j6-qc9x-24h7

ENISA description: In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix of_node_put() on VIP parse errors tegra_vip_channel_of_parse() initializes np from dev->of_node without taking a reference, but its error paths drop one through the err_node_put label. This underflows the refcount of the VIP device's OF node when endpoint parsing fails on a malformed device tree. The only reference the function takes on np is the success-path of_node_get() stored in vip->chan.of_node, and that one is already released by the tegra_vip_init() error path and by tegra_vip_exit(). Return errors directly instead of jumping to the bogus cleanup label.

EUVD references (5)

Affected products (2)

Vendor	Product	Versions	Platforms
Linux	Linux	`e740d199cf0ff1e53ddc2ab067c0a09b55845d68` (affected), `e740d199cf0ff1e53ddc2ab067c0a09b55845d68` (affected), `e740d199cf0ff1e53ddc2ab067c0a09b55845d68` (affected), `e740d199cf0ff1e53ddc2ab067c0a09b55845d68` (affected), `e740d199cf0ff1e53ddc2ab067c0a09b55845d68` (affected)	—
Linux	Linux	`6.5` (affected), `0` (unaffected), `6.6.157` (unaffected), `6.12.109` (unaffected), `6.18.50` (unaffected), `7.2.4` (unaffected), `7.3-rc1` (unaffected)	—

Vendor references (5)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (5)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://git.kernel.org/stable/c/1295ba29ac590bbb5c4a586afd408018168af10b 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/656d047dc0c29c0964d840217a0593f16aa9bc5e 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7393372f79db940acff206b43e2905685a0c57ad 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a3783800c9475fa58b8db0885893f96a23f949da 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/fc9937019cf7e2fe4e29f9341e6400bcd2cde721 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Remediations (10)

CVE-2026-9323 - Red Hat Customer Portal

web:access.redhat.com

Overall, you have the following options: Upgrade to a supported product version that includes a fix for this vulnerability (recommended). Apply a mitigation (if one exists). Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

2026-09-25 10:45 UTC
Security Advisory - Action Required - July 2026 Security Update

web:blog.checkpoint.com

Additional information can be found in the respective Secure Knowledge updates as linked below. IoCs IP addresses observed: 151.241.99 [.]207 151.241.99 [.]233 158.62.198 [.]182 192.142.10 [.]99 139.28.37 [.]250 194.213.18 [.]137 Mitigation Apply the following steps to mitigate the Management vulnerabilities: Limit Trusted Clients (GUI clients) to trusted IP addresses/subnets. Protect ...

2026-09-25 10:45 UTC
Microsoft releases Windows security update addressing 723 ...

web:cyberinsider.com

Microsoft has released its September 2026 security updates, fixing two Windows elevation-of-privilege vulnerabilities that attackers are already exploiting in the wild. The company's broader Patch Tuesday release addresses 974 CVEs across its products, including 723 affecting Windows. The two ...

2026-09-25 10:45 UTC
Adobe Security Bulletins and Advisories | Security

web:helpx.adobe.com

This page contains important information regarding security vulnerabilities that could affect specific versions of Adobe products. Use this information to take the prescribed corrective actions.

2026-09-25 10:45 UTC
Security Advisories and Bulletins | Microsoft Learn

web:learn.microsoft.com

Learning path Learn how Microsoft supports secure software development as part of a cybersecurity solution - Training Secure software development means integrating security into each phase of your development lifecycle, from requirements analysis to maintenance. Microsoft provides many services that can help you develop more secure code and deploy a more secure application in the cloud. This ...

2026-09-25 10:45 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-09-25 10:45 UTC
Cisco Advance Notification for Publication of September 16, 2026 ...

web:sec.cloudapps.cisco.com

On September 16, 2026 , the Cisco Product Security Incident Response Team (PSIRT) published the advisories that are listed in the following tables. To remediate these vulnerabilities, Cisco strongly recommends that customers upgrade to the fixed software that is indicated in the advisories. For more information about changes in Cisco PSIRT vulnerability disclosure, see Strengthening the ...

2026-09-25 10:45 UTC
Oracle Critical Patch Update Advisory - July 2026

web:www.oracle.com

This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.

2026-09-25 10:45 UTC
Oracle Critical Security Patch Update Advisory - June 2026

web:www.oracle.com

Additional CVEs addressed are: The patch for CVE - 2026 -34481 also addresses CVE - 2026 -34477, CVE - 2026 -34478, CVE - 2026 -34479, and CVE - 2026 -34480. Oracle Fusion Middleware Risk Matrix This Critical Security Patch Update contains 106 new security patches for Oracle Fusion Middleware. 53 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a ...

2026-09-25 10:45 UTC
CVE-2026-16232: Critical Check Point SmartConsole ... - Rapid7

web:www.rapid7.com

Mitigation guidance Check Point released Jumbo Hotfixes on July 22, 2026 , to remediate CVE - 2026 -16232, CVE - 2026 -62144, and CVE - 2026 -62145. Organizations running affected versions of Security Management or Multi-Domain Management should install the latest Jumbo Hotfix on an emergency basis, without waiting for a regular patch cycle to occur.

2026-09-25 10:45 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-93223.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/media/tegra-video/vip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a3783800c9475fa58b8db0885893f96a23f949da",
              "status": "affected",
              "version": "e740d199cf0ff1e53ddc2ab067c0a09b55845d68",
              "versionType": "git"
            },
            {
              "lessThan": "1295ba29ac590bbb5c4a586afd408018168af10b",
              "status": "affected",
              "version": "e740d199cf0ff1e53ddc2ab067c0a09b55845d68",
              "versionType": "git"
            },
            {
              "lessThan": "656d047dc0c29c0964d840217a0593f16aa9bc5e",
              "status": "affected",
              "version": "e740d199cf0ff1e53ddc2ab067c0a09b55845d68",
              "versionType": "git"
            },
            {
              "lessThan": "fc9937019cf7e2fe4e29f9341e6400bcd2cde721",
              "status": "affected",
              "version": "e740d199cf0ff1e53ddc2ab067c0a09b55845d68",
              "versionType": "git"
            },
            {
              "lessThan": "7393372f79db940acff206b43e2905685a0c57ad",
              "status": "affected",
              "version": "e740d199cf0ff1e53ddc2ab067c0a09b55845d68",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/staging/media/tegra-video/vip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: media: tegra-video: fix of_node_put() on VIP parse errors\n\ntegra_vip_channel_of_parse() initializes np from dev->of_node without\ntaking a reference, but its error paths drop one through the\nerr_node_put label. This underflows the refcount of the VIP device's\nOF node when endpoint parsing fails on a malformed device tree.\n\nThe only reference the function takes on np is the success-path\nof_node_get() stored in vip->chan.of_node, and that one is already\nreleased by the tegra_vip_init() error path and by tegra_vip_exit().\n\nReturn errors directly instead of jumping to the bogus cleanup label."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T15:21:06.983Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a3783800c9475fa58b8db0885893f96a23f949da"
        },
        {
          "url": "https://git.kernel.org/stable/c/1295ba29ac590bbb5c4a586afd408018168af10b"
        },
        {
          "url": "https://git.kernel.org/stable/c/656d047dc0c29c0964d840217a0593f16aa9bc5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc9937019cf7e2fe4e29f9341e6400bcd2cde721"
        },
        {
          "url": "https://git.kernel.org/stable/c/7393372f79db940acff206b43e2905685a0c57ad"
        }
      ],
      "title": "staging: media: tegra-video: fix of_node_put() on VIP parse errors",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93223",
    "datePublished": "2026-09-24T15:21:06.983Z",
    "dateReserved": "2026-09-17T16:02:15.094Z",
    "dateUpdated": "2026-09-24T15:21:06.983Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}