HIGH
usb PipeArray UAF
CVE-2026-43426
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.0MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: fix use-after-free in ISR during device removal In usbhs_remove(), the driver frees resources (including the pipe array) while the interrupt handler (usbhs_interrupt) is still registered. If an interrupt fires after usbhs_pipe_remove() but before the driver is fully unbound, the ISR may access freed memory, causing a use-after-free. Fix this by calling devm_free_irq() before freeing resources. This ensures the interrupt handler is both disabled and synchronized (waits for any running ISR to complete) before usbhs_pipe_remove() is called.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability in the Renesas USBHS driver can cause kernel memory corruption when the driver is removed while the interrupt handler is still active. This affects systems with Renesas USB host controllers and requires local privileged access to trigger driver unbind (e.g., root shell or module unload). The vulnerability can lead to information disclosure, kernel crashes, or potential code execution.
Vulnerability analysis
The root cause is a race condition in the driver removal path where the interrupt handler remains registered while resources (pipe array) are being freed. If a hardware interrupt fires after usbhs_pipe_remove() frees the pipe array but before the ISR is unregistered, the interrupt handler accesses freed memory. Because the freed memory may be reallocated, this can leak kernel heap contents or cause memory corruption. The fix ensures proper ordering by calling devm_free_irq() to disable and synchronize the interrupt handler before freeing any resources, eliminating the race window.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 5.10 | 5.10.253 | c7012fc73dab |
| 5.15 | 5.15.203 | 51afaf919bba |
| 6.1 | 6.1.167 | 1899edac312e |
| 6.12 | 6.12.78 | 6287e0c01ccb |
| 6.18 | 6.18.19 | 0b7d11fd6e74 |
| 6.19 | 6.19.9 | 6ffe44f022c9 |
| 6.6 | 6.6.130 | 9c6159d5b72d |
| mainline | 7.0 | 3cbc242b88c6 |