What’s Vulnerable › Vulnerabilities

CVE-2026-93126: remoteproc: qcom_q6v5_adsp: Fix reference leak for device node

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-17 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom_q6v5_adsp: Fix reference leak for device node When calling of_parse_phandle_with_args(), the caller is responsible to call of_node_put() to release the reference of device node. In adsp_map_carveout, it does not release the reference.

Affected products

• Linux kernel: 6.3 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/5aed51501447ebb925b0ce0d7d923a9d5ce0bf9e
• https://git.kernel.org/stable/c/7420aac8b1f7e5a75a9d659be3f151dd89de6911
• https://git.kernel.org/stable/c/8c952807c2cebd5e9e9b37146c9383229794c129
• https://git.kernel.org/stable/c/a73cfa80f1ec6b0f948cf3c91455c62423747b3e
• https://git.kernel.org/stable/c/b8bf07b031b202a93d8aa44a4a230a0bbfe0c1fc

Get alerted when CVE-2026-93126 or the next vulnerability affects your stack