Executive brief
The Linux kernel's tegra-video driver contains a use-after-free vulnerability in its device tree node handling during probe initialization. An attacker with local access could trigger a system crash or potentially execute arbitrary code by exploiting improper reference counting of device tree nodes. This affects systems running vulnerable Linux kernels with tegra-video driver enabled.
Technical details
The vulnerability is a use-after-free in the tegra-video CSI (Camera Serial Interface) driver. During device probe, the tegra_csi_channels_alloc() function iterates over device tree child nodes and saves a pointer to each channel's OF node without incrementing its reference count via of_node_get(). When the iteration completes, the kernel automatically decrements the reference count, potentially freeing the node. However, the saved pointer (chan->of_node) is later used in tegra_csi_channels_init() and persists until device removal, creating a window where a freed memory access can occur. The fix adds of_node_get() when storing the node pointer and of_node_put() during cleanup to maintain proper reference counting. Local attackers with probe-triggering capability can cause kernel panics or memory corruption.
Affected products
- Linux Linux kernel Introduced in 1ebaeb09830f; patched in stable series via multiple commits including 0fd003d3c708c80350a815eaf37b8e1114b976cf and 5451efb2ca30f3c42b9efb8327ce35b62870dbd3
Timeline
- 2025-12-24: disclosed: NVD publication date
- 2023-01-07: patched: Patch merged into stable trees via commit 0fd003d3c708c80350a815eaf37b8e1114b976cf
- 2023-01-14: patched: Backported to additional stable series via commit 5451efb2ca30f3c42b9efb8327ce35b62870dbd3