The bug arises in the Linux kernel’s staging media tegra‑video driver. During parsing of a device tree node, the function tegra_vip_channel_of_parse() takes a reference to the node via of_node_get(), but on parse failure it incorrectly calls of_node_put(), decrementing the reference count below zero. This reference count underflow can lead to a use‑after‑free condition, potentially corrupting memory and allowing an attacker to exploit the kernel for arbitrary code execution. The vulnerability is demonstrated on malformed device‐tree input during device initialization, exposing the kernel to memory corruption if it is trusted or crafted.

Any Linux kernel that includes the NVIDIA Tegra video driver in the staging media subsystem is affected. The vendor/product mapping is Linux kernel, stage media tegra‑video. No specific kernel version information is supplied, so the risk applies to all builds that contain the unpatched tegra_vip_channel_of_parse implementation.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating a lower public exploit probability. The CVSS score is not provided, but the impact is severe enough to consider the risk significant. Exploitation requires a maliciously crafted device tree in the boot or initialization phase, meaning the attacker must control the hardware boot environment or firmware. This limitation reduces the likelihood of remote exploitation under normal operation but still poses a high risk in highly controlled or custom embedded deployments.