Cloudanix VulnDB

CVE-2026-93143

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A power-management tracking error in the Linux kernel for certain camera-related hardware could leave internal counters wrong when resuming the device fails, potentially affecting power use or stability over time.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Refcount leak in the ipu7_resume power management callback caused by calling pm_runtime_get_sync without a matching put on failure, leaving the device's runtime PM usage count permanently incremented.

Why it matters to the business

Over repeated resume failures the leaked references can prevent proper power management on affected hardware, leading to higher power draw, thermal issues, or degraded device availability in systems using the ipu7 media driver.

How an attack unfolds

An attacker with local access triggers repeated runtime PM resume failures against the ipu7 device (for example by manipulating power states or device conditions); each failure leaks a reference without an immediate crash, gradually exhausting the ability of the PM core to manage the device correctly.

How to fix it

Update the Linux kernel to a version containing the fix that replaces pm_runtime_get_sync with pm_runtime_resume_and_get in ipu7_resume and ensures balanced reference counting on error paths.

How to confirm the fix worked

Inspect the ipu7 driver source for the presence of pm_runtime_resume_and_get in the resume callback and confirm that error paths explicitly balance usage counts; test by inducing resume failures and verifying the usage counter returns to its prior value.

Typical attack path

  1. Obtain local access to a system containing the vulnerable ipu7 staging driver
  2. Force or induce runtime PM resume operations that fail
  3. Repeat the failure path to accumulate leaked pm_runtime references
  4. Observe side effects such as inability to suspend the device or elevated power usage

How to detect it

Review kernel logs for repeated ipu7 resume failures combined with steadily increasing pm_runtime usage counts visible via /sys/kernel/debug or similar interfaces; no remote or network indicators are expected.

What your security team should do

  • Apply the upstream kernel fix that replaces pm_runtime_get_sync with pm_runtime_resume_and_get
  • Prioritize patching on systems that use the ipu7 media hardware or staging drivers
  • Monitor kernel changelogs for the exact commit that landed the correction

The record

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume() ipu7_resume() calls pm_runtime_get_sync() before resuming the device. If the runtime PM resume fails, the usage count remains incremented, but the error path returns without dropping the reference. Use pm_runtime_resume_and_get() instead, which balances the usage count on failure and avoids the leak. Keep returning 0 on error, as resume callbacks should not propagate failures to the PM core, matching the behaviour of the ipu6 driver.

Affected packages

Ecosystem Package Introduced Fixed