CVE-2026-93276: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator
In the Linux kernel, the following vulnerability has been resolved:
phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator
devmregulatorgetexclusive() initialises the regulator with enablecount = 1, requiring the consumer to disable it before release.
The devm disable action was previously only registered when the caller explicitly requested enable, so when the regulator was left in its initial enabled state without an explicit enable call, the cleanup path skipped decrementing enablecount, triggering a WARNON during regulator release on device removal.
Fix this by always registering the devm disable action based on the actual enabled state via regulatorisenabled(), regardless of whether the caller requested an explicit enable. This covers both the explicitly enabled case and the initial state set by devmregulatorgetexclusive().
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by this cleanup-path issue?
Systems using the Renesas R-Car Gen3 USB2 PHY driver can encounter it when the driver acquires the VBUS regulator exclusively but does not explicitly request that it be enabled. The regulator may still have an initial enable count of one, leaving cleanup without the required disable action.
How can I tell whether the issue has occurred?
The documented symptom is a WARN_ON during regulator release when the device is removed. This occurs because the regulator enable count was not decremented before release.
What should be done if the affected driver is in use?
Use a kernel build containing the referenced fix, which registers the managed disable action according to the regulator's actual enabled state. No separate configuration workaround is described in the available information.