HIGH Introduced in 7.0
phy RcarGen2 DoubleFree
CVE-2026-90288
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure for_each_child_of_node_scoped() releases the node reference on scope exit, so the explicit of_node_put(np) in the devm_phy_create() error path drops it twice. Drop the redundant of_node_put() and let the scoped cleanup handle it.
02KernelScan AI Analysis
Risk summary
A double reference decrement on a device tree node occurs in the Renesas R-Car Gen2 PHY driver when PHY creation fails during device probe. An attacker who can control or tamper with the boot-time device tree could trigger this to cause a use-after-free, leading to kernel memory corruption or a panic. This requires either root access to modify boot configuration or physical access to alter the device tree, and is limited to systems using the R-Car Gen2 SoC.
Vulnerability analysis
During device probe, the Renesas R-Car Gen2 PHY driver iterates over device tree child nodes using a scoped loop that automatically releases each node reference when the loop scope exits. However, the error path when PHY creation fails also explicitly releases the same node reference, causing the reference count to be decremented twice. This premature release can free the device tree node while other kernel code still holds a reference to it, resulting in a use-after-free. The fix removes the redundant explicit release call and relies solely on the scoped loop cleanup. The vulnerable path is reached only at boot time during driver probe on R-Car Gen2 hardware, and deliberately triggering it requires control over the device tree supplied to the kernel, which means an attacker needs either root-level access to boot configuration or physical access to modify firmware or bootloader settings.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 7.0 | 7.2.6 | 5374f3d53376 |
| mainline | 7.0 | 7.3-rc1 | b780b8929c75 |