CVE-2026-43426
Use-After-Free in Renesas USBHS Linux Kernel Driver
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| renesas | renesas_usbhs | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Renesas USBHS driver. It is a use-after-free issue that occurs during device removal. Specifically, the driver frees resources, including the pipe array, while the interrupt handler is still registered. If an interrupt occurs after the pipe removal but before the driver is fully unbound, the interrupt service routine (ISR) may access memory that has already been freed, leading to undefined behavior or crashes.
The fix involves calling devm_free_irq() before freeing resources, which disables and synchronizes the interrupt handler to ensure no ISR is running when the resources are freed.
How can this vulnerability impact me? :
This vulnerability can cause the system to access freed memory, which may lead to system instability, crashes, or potential exploitation by attackers to execute arbitrary code or cause denial of service. The use-after-free condition in the interrupt handler can compromise the reliability and security of the affected device driver.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the fix has been applied. The fix involves calling devm_free_irq() before freeing resources in the usbhs_remove() function to properly disable and synchronize the interrupt handler before resource cleanup.
If updating the kernel is not immediately possible, avoid removing Renesas USBHS devices while interrupts may still be active, as this can trigger the use-after-free condition.