CVE-2026-90288: phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure
Published Sep 17, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
phy: renesas: rcar-gen2: Fix double ofnodeput on phy creation failure
foreachchildofnodescoped() releases the node reference on scope exit, so the explicit ofnodeput(np) in the devmphycreate() error path drops it twice.
Drop the redundant ofnodeput() and let the scoped cleanup handle it.
Event History
Sep 17, 2026
CVE Published
via MITRE·04:08 PM
Data Sourced
via MITRE·04:08 PM
Description
Frequently Asked Questions
1
Under what condition is the double reference release triggered?
It is triggered when devm_phy_create() fails while the driver is iterating child device-tree nodes during PHY creation.
2
What is the immediate mitigation if the fix cannot be deployed?
No workaround or mitigation is provided in the available information. The referenced stable kernel changes remove the redundant of_node_put() call.