Executive brief
The Linux kernel's r8a66597 USB device controller driver contains a memory management bug in its initialization code. If the USB gadget device registration fails, the driver attempts to free the same memory block twice, which can cause system instability or a kernel crash. This affects systems that use Renesas r8a66597 USB controller hardware.
Technical details
The vulnerability is a double-free memory corruption in the r8a66597_probe() function. When usb_add_gadget_udc() fails, the error handler at err_add_udc frees the ep0_req request object, then execution falls through to clean_up2 which frees it again due to a non-NULL check. The fix removes the redundant free from the err_add_udc label, ensuring the request is released exactly once. The bug was triggered during probe initialization failure and could lead to heap corruption or denial of service. A patch addressing this has been committed to the Linux stable kernel tree.
Affected products
- Linux Linux kernel Multiple versions (see git history; patched in stable trees)
Timeline
- 2026-09-17: disclosed: Published as CVE-2026-93141
- 2026-07-08: patched: Fix committed upstream (41d541e3718db01668a4cd29815ee4b3b55f76d2)
- 2026-09-14: patched: Fix backported to stable trees (150d3f3c461345b6c9ae784912cf1e49c8e5ff6b)