Executive brief
A vulnerability in the Linux kernel's Renesas USB driver could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when the system attempts to remove a Renesas USB device, where the software incorrectly manages memory while still processing hardware signals. This could lead to unpredictable system behavior or a complete service outage during hardware maintenance or removal.
Technical details
A use-after-free (UAF) vulnerability exists in the Renesas USBHS driver (drivers/usb/renesas_usbhs/common.c) within the Linux kernel. In the `usbhs_remove()` function, the driver deallocates resources, including the pipe array, while the interrupt service routine (ISR) `usbhs_interrupt` is still registered. If a hardware interrupt is triggered after `usbhs_pipe_remove()` but before the driver is fully unbound, the ISR may attempt to access the previously freed memory. The fix involves explicitly calling `devm_free_irq()` before resource deallocation to ensure the interrupt handler is disabled and any running ISR instances are synchronized/completed.
Affected products
- Linux Linux kernel All versions prior to the fix in 2026
Timeline
- 2026-03-03: other: Patch submitted by developer
- 2026-03-11: patched: Fix committed to Linux stable tree
- 2026-05-08: disclosed: CVE-2026-43426 published
References
- https://git.kernel.org/stable/c/0b7d11fd6e742ecc0b1eca44b4f0b93140c74bae
- https://git.kernel.org/stable/c/1899edac312ef17a7234851686e8a703f56d0a84
- https://git.kernel.org/stable/c/3cbc242b88c607f55da3d0d0d336b49bf1e20412
- https://git.kernel.org/stable/c/51afaf919bbaacdd9cc9e146033ae0a743a42dd7
- https://git.kernel.org/stable/c/6287e0c01ccb818e7214f88d885ffb7c9e81b0e0
- https://git.kernel.org/stable/c/6ffe44f022c95b1b29c691d2169c5abc046f7580
- https://git.kernel.org/stable/c/9c6159d5b72d5fc265cce5da04f27d730b552e69