CVE-2026-43294 Overview
CVE-2026-43294 is a Linux kernel vulnerability in the Renesas RZ/G2L MIPI Display Serial Interface (MIPI-DSI) driver. The flaw causes a kernel panic during system reboot when certain display panels are connected. Specifically, panels that issue MIPI-DSI commands in their unprepare() callback trigger a system error because the MIPI-DSI interface has already been stopped at that point.
The regression was introduced by commit 56de5e305d4b ("clk: renesas: r9a07g044: Add MSTOP for RZ/G2L"). The bug affects the drm/renesas/rz-du/mipi_dsi subsystem and manifests during the shutdown path through rzg2l_mipi_dsi_host_transfer().
Critical Impact
A local condition during reboot causes a kernel panic, resulting in an unclean system shutdown and potential availability impact on affected Renesas RZ/G2L-based devices.
Affected Products
- Linux Kernel (mainline) on Renesas RZ/G2L platforms using the rz-du MIPI-DSI driver
- Systems pairing the RZ/G2L MIPI-DSI host with panels that send DSI commands during unprepare() (for example, ili9881c)
- Kernels including commit 56de5e305d4b prior to the fix
Discovery Timeline
- 2026-05-08 - CVE-2026-43294 published to NVD
- 2026-05-14 - Last updated in NVD database
Technical Details for CVE-2026-43294
Vulnerability Analysis
The vulnerability is a kernel driver flaw [CWE-noinfo] in the Renesas RZ/G2L MIPI-DSI host driver located under drivers/gpu/drm/renesas/rz-du/. During a reboot, the Direct Rendering Manager (DRM) framework invokes the panel's unprepare() callback. For panels such as ili9881c, this callback issues MIPI-DSI commands like mipi_dsi_dcs_set_display_off_multi() to gracefully power down the display.
The call chain reaches rzg2l_mipi_dsi_host_transfer(), which attempts to drive the DSI hardware. However, the MIPI-DSI interface has already been stopped earlier in the disable sequence, producing a synchronous external abort (do_serror) and a kernel panic on ARM64.
Root Cause
The regression originates in commit 56de5e305d4b ("clk: renesas: r9a07g044: Add MSTOP for RZ/G2L"), which gates clocks via the module stop (MSTOP) mechanism. With clocks gated after the DSI was stopped, any subsequent DSI register access from a panel's unprepare() callback faults the bus. The driver stopped the DSI controller too early in the atomic disable path, before panels with deferred DSI traffic had a chance to send their shutdown commands.
Attack Vector
The condition is reachable locally during a normal reboot or shutdown sequence on affected hardware. An attacker with local low-privilege access who can trigger a reboot on a vulnerable Renesas RZ/G2L device with a qualifying panel can force a kernel panic, denying service. Exploitation does not yield code execution, memory disclosure, or integrity loss; impact is limited to availability.
The fix relocates rzg2l_mipi_dsi_stop() from the atomic disable callback to a new rzg2l_mipi_dsi_atomic_post_disable() callback. This guarantees the panel's unprepare() can still issue DSI traffic before the controller and its clocks are stopped, restoring the correct power-down ordering.
Detection Methods for CVE-2026-43294
Indicators of Compromise
- Kernel oops or panic logs containing rzg2l_mipi_dsi_host_transfer in the call trace during shutdown or reboot
- do_serror / el1h_64_error_handler entries on ARM64 systems running Renesas RZ/G2L kernels
- Repeated unclean shutdowns or watchdog-triggered resets on devices using the rz-du MIPI-DSI driver with panels such as ili9881c
Detection Strategies
- Inventory kernels for the presence of commit 56de5e305d4b without the remediating commits 41cda667ffc5, 64aa8b3a60a8, or 79f42487ed60
- Correlate device tree configurations using renesas,rzg2l-mipi-dsi with panel drivers that implement DSI commands in unprepare()
- Review serial console captures and kdump artifacts from impacted devices for the documented call trace
Monitoring Recommendations
- Forward kernel logs from embedded Linux fleets to a centralized log pipeline and alert on panic strings referencing rzg2l_mipi_dsi
- Track reboot reason codes and unclean shutdown counters on Renesas-based deployments
- Add regression tests that exercise full reboot cycles on hardware integrating affected DSI panels before rolling out kernel updates
How to Mitigate CVE-2026-43294
Immediate Actions Required
- Apply the upstream fix that introduces rzg2l_mipi_dsi_atomic_post_disable() and moves rzg2l_mipi_dsi_stop() out of the atomic disable path
- Rebuild and deploy kernels for all Renesas RZ/G2L devices using the rz-du MIPI-DSI driver
- Validate reboot and shutdown sequences on every panel SKU shipped with affected hardware
Patch Information
The fix has been merged into the stable Linux kernel trees. Refer to the upstream commits: Linux Kernel Commit 41cda667ffc5, Linux Kernel Commit 64aa8b3a60a8, and Linux Kernel Commit 79f42487ed60. Integrate the corresponding patches into vendor BSPs and downstream kernel branches.
Workarounds
- Where feasible, restrict local access on affected Renesas RZ/G2L devices to reduce the population of users who can trigger reboots
- Temporarily replace panels whose drivers issue DSI commands in unprepare() with panels that do not, until the patched kernel is deployed
- Disable the affected display pipeline on systems where the display is non-essential, preventing the faulting code path during shutdown
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
