CVE-2026-90288 (GCVE-0-2026-90288)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:08 – Updated: 2026-09-18 17:54
VLAI
Title
phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure
Summary
In the Linux kernel, the following vulnerability has been resolved: phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure for_each_child_of_node_scoped() releases the node reference on scope exit, so the explicit of_node_put(np) in the devm_phy_create() error path drops it twice. Drop the redundant of_node_put() and let the scoped cleanup handle it.
Severity
7.4 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b64b32791fb557f922beebddf74c47baf338cef0 , < 5374f3d53376d35085e0727c8c1b945bf7123996 (git)
Affected: b64b32791fb557f922beebddf74c47baf338cef0 , < b780b8929c759cfa7a892d58625a5ad46cb1cbd2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/phy/renesas/phy-rcar-gen2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5374f3d53376d35085e0727c8c1b945bf7123996",
              "status": "affected",
              "version": "b64b32791fb557f922beebddf74c47baf338cef0",
              "versionType": "git"
            },
            {
              "lessThan": "b780b8929c759cfa7a892d58625a5ad46cb1cbd2",
              "status": "affected",
              "version": "b64b32791fb557f922beebddf74c47baf338cef0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/phy/renesas/phy-rcar-gen2.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure\n\nfor_each_child_of_node_scoped() releases the node reference on scope\nexit, so the explicit of_node_put(np) in the devm_phy_create() error\npath drops it twice.\n\nDrop the redundant of_node_put() and let the scoped cleanup handle it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The extra of_node_put(np) runs only in rcar_gen2_phy_probe() after a failed devm_phy_create() on a usb-phy@0/@2 child, reached via platform_probe() when the renesas,rcar-gen2-usb-phy device (usb-phy-controller@e6590100) is bound from DT; USB transfers and network packets never enter this probe.\nAC:H - The double put runs only when phy_create() fails inside rcar_gen2_phy_probe() (kzalloc/ida_alloc/devres_alloc ENOMEM, regulator_get_optional(\"phy\") -EPROBE_DEFER, or device_add failure). Those GFP_KERNEL/sysfs failures are not attacker-controlled, and of_node_put() is a no-op unless CONFIG_OF_DYNAMIC is enabled.\nPR:N - rcar_gen2_phy_probe() has no capable() check; with PHY_RCAR_GEN2=y (shmobile_defconfig) platform_probe() binds usb-phy-controller@e6590100 during kernel init on boards that set \u0026usbphy { status = \"okay\" }, so the failed-create path needs no user account. Sysfs bind is 0200 root-only but is not required for that boot path.\nUI:N - Lager, Koelsch, Porter, Silk, and iwg23s-sbc enable \u0026usbphy/\u0026usbphy0 in DT, so of_platform populate plus platform_probe() run rcar_gen2_phy_probe() unattended at boot; no mount, open, or USB plug-in is required to hit the devm_phy_create() error path.\nS:U - kobject_cleanup() of the still-attached usb-phy@0 device_node and the extra put on its parent usb-phy-controller node occur in host kernel OF/kobject code; this is not a KVM/Xen escape or IOMMU/DMA bypass.\nC:H - When the second of_node_put(np) drops the usb-phy@0 kobject to zero, kobject_cleanup() kfree_const()s kobj-\u003ename while the node stays in the OF tree and rcar_gen2_phy_xlate() still compares args-\u003enp to channel-\u003eof_node; later kobject_name() reads reclaimed heap, and of_node_release()\u0027s dump_stack() leaks kernel pointers.\nI:H - kobject_cleanup() also __kobject_del()s the live usb-phy@0 sysfs dir and kobject_put()s the parent controller node, leaving a released kobject with a dangling name pointer still linked via channel-\u003eof_node; reclaiming that name slab plus later kobject_get/put on the zero-ref kobject provides write and control-flow primitives.\nA:H - of_node_release() prints \"detected bad of_node_put()\" and dump_stack() for the still-attached usb-phy@0 node; the next of_node_get/put hits refcount_t underflow/UAF (panic under panic_on_warn), and tearing down /sys/firmware/devicetree for a node still used by rcar_gen2_phy_xlate() can oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:17.876Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5374f3d53376d35085e0727c8c1b945bf7123996"
        },
        {
          "url": "https://git.kernel.org/stable/c/b780b8929c759cfa7a892d58625a5ad46cb1cbd2"
        }
      ],
      "title": "phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90288",
    "datePublished": "2026-09-17T16:08:16.686Z",
    "dateReserved": "2026-09-11T19:38:34.798Z",
    "dateUpdated": "2026-09-18T17:54:17.876Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90288",
      "date": "2026-09-25",
      "epss": "0.00154",
      "percentile": "0.03813"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/phy/renesas/phy-rcar-gen2.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "5374f3d53376d35085e0727c8c1b945bf7123996",
                    "status": "affected",
                    "version": "b64b32791fb557f922beebddf74c47baf338cef0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b780b8929c759cfa7a892d58625a5ad46cb1cbd2",
                    "status": "affected",
                    "version": "b64b32791fb557f922beebddf74c47baf338cef0",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/phy/renesas/phy-rcar-gen2.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.0"
                  },
                  {
                    "lessThan": "7.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nphy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure\n\nfor_each_child_of_node_scoped() releases the node reference on scope\nexit, so the explicit of_node_put(np) in the devm_phy_create() error\npath drops it twice.\n\nDrop the redundant of_node_put() and let the scoped cleanup handle it."
          }
        ],
        "id": "CVE-2026-90288",
        "lastModified": "2026-09-18T18:17:51.750",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.4,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:25.860",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5374f3d53376d35085e0727c8c1b945bf7123996"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b780b8929c759cfa7a892d58625a5ad46cb1cbd2"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.