rootpwn

high · CVSS v3 7.1

CVE-2026-93193

A high‑severity memory leak was discovered in the Linux kernel’s Rockchip DRM driver for Analogix DisplayPort. The leak occurs when device t

Overview

A high‑severity memory leak was discovered in the Linux kernel’s Rockchip DRM driver for Analogix DisplayPort. The leak occurs when device tree nodes are not properly released, potentially exhausting kernel memory over time.

Description

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: analogix_dp: Fix OF node reference leak via auto cleanup Sashiko reported a reference leak in rockchip_dp_drm_encoder_enable(), the of_get_child_by_name() function does not call of_node_put() in a symmetrical way [1]. Fix the device node reference leak by using __free(device_node) to automatically manage of_node_put() for all device nodes.

Impact

The leak can lead to gradual kernel memory exhaustion, resulting in a denial‑of‑service condition on affected devices. Confidentiality and integrity are not directly impacted.

Remediation

Update the kernel to a version that includes the patch fixing the reference leak (or apply the upstream patch to the drm/rockchip driver). Verify that custom builds or modules use the updated driver and that device tree nodes are correctly cleaned up.

Risk context

Severity is high (CVSS 7.1). While no exploit code is known, the memory‑leak can cause availability degradation on systems with limited memory, making prompt patching advisable.

Affected products

  • Linux kernel
  • Rockchip SoC
  • RK3399
  • RK3568
  • RK3588
  • Analogix DP driver
  • drm/rockchip

Scores

Severity
high
CVSS v2
5.6
CVSS v3
7.1
CVSS v4
—
EPSS
—

memory-leak kernel rockchip drm dp denial-of-service device-tree resource-exhaustion

← All CVEs

Related CVEs

high

CVE-2026-93203

A race condition in the batman-adv kernel module can corrupt the CRC used to validate claim frames, leading to incorrect routing information in mesh networks. The flaw may cause routing tables to become inconsistent, potentially disrupting network connectivity.

View analysis

high

CVE-2026-93156

In the Linux kernel, the following vulnerability has been resolved: crypto: rk3288 - fail ahash requests on HASH idle timeout rk_hash_run() waits for RK_CRYPTO_HASH_STS to become idle after the final DMA transfer, but ignores the poll result. If the hash engine never becomes idle, the driver still reads the digest registers and finalizes the request with the previous success value. Store the poll result and finalize the request with the timeout error before reading the digest registers.

View analysis

high

CVE-2026-93161

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - clear AES key schedule from stack qat_alg_xts_reverse_key() expands the forward XTS AES key on the stack. That schedule contains key material and can remain in the stack frame. Clear the temporary crypto_aes_ctx with memzero_explicit() after the copy.

View analysis

high

CVE-2026-93162

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - cancel work on re-enable SR-IOV timeout The QAT reset worker queues SR-IOV reenable work using a work_struct and completion embedded in an on-stack adf_sriov_dev_data. If the completion wait times out, the reset worker can return while device_sriov_wq still holds or executes the stack-backed work item. Cancel the work on the device_sriov_wq on timeout before the stack frame unwinds.

View analysis