CVE-2026-43426: usb: renesas_usbhs: fix use-after-free in ISR during device removal
In the Linux kernel, the following vulnerability has been resolved:
usb: renesasusbhs: fix use-after-free in ISR during device removal
In usbhsremove(), the driver frees resources (including the pipe array) while the interrupt handler (usbhsinterrupt) is still registered. If an interrupt fires after usbhspiperemove() but before the driver is fully unbound, the ISR may access freed memory, causing a use-after-free.
Fix this by calling devmfreeirq() before freeing resources. This ensures the interrupt handler is both disabled and synchronized (waits for any running ISR to complete) before usbhspiperemove() is called.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel's Renesas USBHS driver are exposed during removal or unbinding of the affected device driver. Exploitation requires local access and low privileges, according to the CVSS vector.
What condition triggers the use-after-free?
The issue occurs if an interrupt is delivered after usbhs_pipe_remove() frees the pipe array and related resources, but before the driver has been fully unbound. The still-registered usbhs_interrupt handler can then dereference freed memory.
What is the impact if exploitation succeeds?
The vulnerability is rated high with CVSS 7.8 and has high confidentiality, integrity, and availability impact. It can result in access to or modification of data and disruption of the affected system.
What should be done if patching is not immediately possible?
The provided data identifies a patch as available but does not specify a workaround. Prioritize applying the available kernel fix, which frees the IRQ before resource removal so the interrupt handler is disabled and synchronized.