UBUNTU-CVE-2026-93276: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator devmregulatorgetexclusive() initialises the regulator with enablecount = 1, requiring the consumer to disable it before release. The devm disable action was previously only registered when the caller explicitly requested enable, so when the regulator was left in its initial enabled state without an explicit enable call, the cleanup path skipped decrementing enablecount, triggering a WARNON during regulator release on device removal. Fix this by always registering the devm disable action based on the actual enabled state via regulatorisenabled(), regardless of whether the caller requested an explicit enable. This covers both the explicitly enabled case and the initial state set by devmregulatorgetexclusive().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Always register the devm regulator-disable action when the VBUS regulator is enabled according to regulator_is_enabled(), regardless of whether the caller explicitly requested enable.
Linux kernel phy: renesas: phy-rcar-gen3-usb2 devm disable action registration = Register based on regulator_is_enabled()
Event History
Frequently Asked Questions
Which systems are most likely to encounter this issue?
The issue is in the Renesas R-Car Gen3 USB2 PHY driver and involves its handling of a VBUS regulator. It applies to the listed Ubuntu kernel packages when that driver uses devm_regulator_get_exclusive() and the regulator remains in its initial enabled state.
What event triggers the observable failure?
The problematic cleanup path runs when the device is removed. If the regulator's enable count was initialized to 1 but no devm disable action was registered, regulator release triggers a WARN_ON because the enable count was not decremented.
How can I tell whether this is affecting a system?
Look for a WARN_ON during regulator release associated with device removal in systems using the Renesas R-Car Gen3 USB2 PHY driver. The warning indicates that the cleanup path released a regulator whose enable count had not been properly decremented.