CVE-2026-43426

usb: renesas_usbhs: fix use-after-free in ISR during device removal

published May 8, 2026

CVSS
—
EPSS
0%
Percentile
6.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

usb: renesas_usbhs: fix use-after-free in ISR during device removal

In usbhs_remove(), the driver frees resources (including the pipe array)

while the interrupt handler (usbhs_interrupt) is still registered. If an

interrupt fires after usbhs_pipe_remove() but before the driver is fully

unbound, the ISR may access freed memory, causing a use-after-free.

Fix this by calling devm_free_irq() before freeing resources. This ensures

the interrupt handler is both disabled and synchronized (waits for any

running ISR to complete) before usbhs_pipe_remove() is called.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00171 · 6.2th percentile
Published
2026-05-08T14:21Z
EPSS history
Timeline
  • 08 MAY 14:21Z
    usb: renesas_usbhs: fix use-after-free in ISR during device removal
    cvelistv5