CVE-2026-43426

Vulnerability

In the Linux kernel's renesas_usbhs driver, a use-after-free vulnerability exists during device removal. The usbhs_remove() function frees resources, including the pipe array, before the interrupt handler (usbhs_interrupt) is deregistered. If an interrupt fires after usbhs_pipe_remove() but before the driver is fully unbound, the ISR may access freed memory [1][2][3].

Exploitation

An attacker with physical access or control over the USB device could potentially trigger a removal sequence (e.g., unbind the driver or disconnect the device) while interrupts remain enabled. No special privileges beyond normal user access to trigger device removal are required, though the attack surface is limited to systems using the renesas_usbhs driver.

Impact

Successful exploitation could lead to memory corruption, system crash (denial of service), or potentially arbitrary code execution in kernel context, depending on the memory layout and timing.

Mitigation

The fix, backported to stable kernel branches [1][2][3], ensures that devm_free_irq() is called before freeing resources. This disables the interrupt and waits for any in-progress ISR to complete, eliminating the race condition.