Junglewise Threat Intelligence

CVE-2026-43426: Linux Kernel use-after-free in Renesas USBHS driver

CVE-2026-43426 · Severity: high · CVSS 7.8 · Published 2026-05-08

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Renesas USB driver could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when the system attempts to remove a Renesas USB device, where the software incorrectly manages memory while still processing hardware signals. This could lead to unpredictable system behavior or a complete service outage during hardware maintenance or removal.

Technical details

A use-after-free (UAF) vulnerability exists in the Renesas USBHS driver (drivers/usb/renesas_usbhs/common.c) within the Linux kernel. In the `usbhs_remove()` function, the driver deallocates resources, including the pipe array, while the interrupt service routine (ISR) `usbhs_interrupt` is still registered. If a hardware interrupt is triggered after `usbhs_pipe_remove()` but before the driver is fully unbound, the ISR may attempt to access the previously freed memory. The fix involves explicitly calling `devm_free_irq()` before resource deallocation to ensure the interrupt handler is disabled and any running ISR instances are synchronized/completed.

Affected products

  • Linux Linux kernel All versions prior to the fix in 2026

Timeline

  • 2026-03-03: other: Patch submitted by developer
  • 2026-03-11: patched: Fix committed to Linux stable tree
  • 2026-05-08: disclosed: CVE-2026-43426 published

References

Related threats