What’s Vulnerable › Vulnerabilities

CVE-2026-93143: staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume()

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-17 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume() ipu7_resume() calls pm_runtime_get_sync() before resuming the device. If the runtime PM resume fails, the usage count remains incremented, but the error path returns without dropping the reference. Use pm_runtime_resume_and_get() instead, which balances the usage count on failure and avoids the leak. Keep returning 0 on error, as resume callbacks should not propagate failures to the PM core, matching the behaviour of the ipu6 driver.

Affected products

• Linux kernel: 6.17 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/437d6d15936db87485afabf7d52754b7b19cc787
• https://git.kernel.org/stable/c/593fda71983b9c23c84a566b20c53dc402c6b376
• https://git.kernel.org/stable/c/b298b80814dd0fc3cb1c8c0e0082fc14fdb5fecf

Get alerted when CVE-2026-93143 or the next vulnerability affects your stack