CVE-2026-43175 Overview
CVE-2026-43175 is an out-of-bounds write vulnerability in the Linux kernel's Renesas 9-series (rs9) clock generator driver. The driver supports the 9FGV0841 chip, which exposes 8 clock outputs and registers 8 struct clk_hw instances. The driver allocated insufficient slots in the clk_dif pointer array within struct rs9_driver_data, causing writes to indices 4 through 7 to overflow into adjacent structure members.
The corruption silently damages struct rs9_driver_data and surrounding kernel memory. Crashes typically surface when the driver is unbound or during system suspend rather than at registration time.
Critical Impact
Out-of-bounds writes in the rs9 clock driver corrupt kernel memory and lead to kernel crashes during driver unbind or suspend operations on systems using the 9FGV0841 clock generator.
Affected Products
- Linux kernel versions containing the rs9 clock driver with support for the 9FGV0841 chip
- Systems using the Renesas 9FGV0841 clock generator with affected kernel builds
- Stable kernel branches prior to the commits referenced in the upstream fix
Discovery Timeline
- 2026-05-06 - CVE-2026-43175 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43175
Vulnerability Analysis
The Renesas rs9 driver maintains a fixed-size array of struct clk_hw pointers named clk_dif inside struct rs9_driver_data. The array was sized for fewer outputs than the 9FGV0841 chip provides. When the driver registers all 8 outputs of the 9FGV0841, it writes pointers to clk_dif[4] through clk_dif[7], which lie beyond the allocated array bounds.
These writes overwrite adjacent fields in struct rs9_driver_data and any data laid out after the structure. Because the corrupted memory may not be referenced immediately, the kernel often continues running with damaged state. The damage becomes visible when the driver is unbound or when the system enters suspend, paths that dereference the corrupted members.
This is a classic out-of-bounds write [CWE-787] caused by an undersized fixed array failing to accommodate the largest device variant supported by the driver.
Root Cause
The root cause is an incorrect compile-time size for the clk_dif pointer array in struct rs9_driver_data. The driver supports multiple Renesas clock generator variants, and the array was not sized to the maximum output count among supported chips. The 9FGV0841 has 8 outputs, exceeding the array capacity and producing deterministic out-of-bounds writes when the driver probes that part.
Attack Vector
Exploitation requires the kernel to load the rs9 driver against a 9FGV0841 device, which is determined by hardware presence and Device Tree or ACPI configuration. The condition is triggered by normal probe, unbind, and suspend flows rather than by unprivileged user input. The practical impact is kernel memory corruption and system instability on affected hardware platforms.
No verified public exploit code exists for this issue. The upstream fix increases the clk_dif array size to match the maximum output count of the largest supported chip. See the upstream commits for the patch contents: Kernel Git Commit 2f92687, Kernel Git Commit 5ec820f, Kernel Git Commit 82a34f3, and Kernel Git Commit da86ca1.
Detection Methods for CVE-2026-43175
Indicators of Compromise
- Kernel oops or panic messages referencing the rs9 driver, clk_dif, or rs9_driver_data during driver unbind or system suspend
- KASAN reports flagging out-of-bounds writes inside the rs9 probe path on kernels built with CONFIG_KASAN
- Unexpected clock subsystem failures on platforms equipped with the Renesas 9FGV0841 clock generator
Detection Strategies
- Audit running kernel versions across Linux fleets and compare against the patched stable releases referenced in the upstream commits
- Enable KASAN in test and pre-production builds to surface the out-of-bounds write at driver probe time
- Inspect dmesg and persistent kernel logs for rs9 driver errors correlated with suspend or unbind events
Monitoring Recommendations
- Forward kernel logs to a centralized logging pipeline and alert on rs9 or clock framework warnings, oopses, and panics
- Track suspend and resume failure rates on hardware that uses the 9FGV0841 to surface latent corruption
- Monitor unplanned reboots on embedded and edge Linux systems where this clock generator is deployed
How to Mitigate CVE-2026-43175
Immediate Actions Required
- Identify Linux systems running kernels that include the rs9 driver and use the 9FGV0841 clock generator
- Apply the upstream stable kernel update that resizes the clk_dif array to the maximum supported output count
- Reboot affected systems after patching to ensure the fixed driver is loaded in place of the vulnerable version
Patch Information
The fix increases the struct clk_hw pointer array size in struct rs9_driver_data to the maximum output count of the largest supported chip (9FGV0841 with 8 outputs). The patch is available in the following upstream stable commits: Kernel Git Commit 2f92687, Kernel Git Commit 5ec820f, Kernel Git Commit 82a34f3, and Kernel Git Commit da86ca1. Distribution maintainers should pick up the corresponding stable backports.
Workarounds
- On systems that do not require the 9FGV0841, blacklist or unbuild the rs9 clock driver until the kernel is patched
- Avoid driver unbind operations and suspend cycles on affected hardware where patching cannot be performed immediately
- Constrain Device Tree or firmware configuration to avoid binding the rs9 driver to 9FGV0841 instances on unpatched kernels
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
