Executive brief
The Linux kernel's Qualcomm Q6V5 ADSP remote processor driver contains a memory reference leak in its device carveout mapping function. When parsing device tree properties, the driver fails to properly release a reference to a device node, causing the reference counter to remain elevated and potentially exhausting kernel memory over time. This can lead to kernel memory pressure and system instability.
Technical details
This is a reference-counting bug in the `adsp_map_carveout()` function within the qcom_q6v5_adsp remote processor driver. When `of_parse_phandle_with_args()` is called to parse device tree arguments, it increments the reference count of the returned device node. The caller is responsible for calling `of_node_put()` to release this reference; however, the vulnerable code path omits this cleanup. The impact is a kernel memory leak that accumulates with each call to the carveout mapping function. A fix is available in the Linux kernel stable tree (commit 8c952807c2cebd5e9e9b37146c9383229794c129), which adds the missing `of_node_put(args.np)` call after extracting the SID value.
Affected products
- Linux Linux kernel multiple kernel versions affected; fix available in stable tree
Timeline
- 2026-09-17: disclosed: CVE-2026-93126 published
- 2026-09-14: patched: Fix merged into Linux kernel stable tree