Executive brief
The Renesas RCAR Gen2 PHY driver in the Linux kernel contains a resource management bug where a device tree node reference is released twice during PHY creation failure. This double-release can cause memory corruption or system instability on Renesas SoC platforms using this driver during error conditions.
Technical details
The vulnerability is a double-release of a device tree node reference (use-after-free on memory management) in the rcar-gen2 PHY probe function. The root cause is that for_each_child_of_node_scoped() automatically releases the node reference at scope exit, but the error path in devm_phy_create() also explicitly called of_node_put(np), causing a double release. The fix removes the redundant of_node_put() call and lets the scoped cleanup handle the reference release automatically. This is a local kernel memory management bug affecting systems with Renesas RCAR Gen2 PHY hardware during device probe failure scenarios.
Affected products
- Linux Linux kernel 4.x through 7.x (affected versions vary by stable branch)
Timeline
- 2026-09-17: disclosed: CVE published
- 2026-08-06: patched: Fix merged upstream (commit b780b8929c759cfa7a892d58625a5ad46cb1cbd2)
- 2026-09-14: other: Fix backported to stable branches