CVE-2026-43426 Overview
CVE-2026-43426 is a use-after-free vulnerability in the Linux kernel's renesas_usbhs USB driver. The flaw resides in the device removal path, where usbhs_remove() frees driver resources, including the pipe array, while the usbhs_interrupt handler remains registered. An interrupt arriving after usbhs_pipe_remove() but before the driver is fully unbound can dereference freed memory. This race condition between the interrupt service routine (ISR) and driver teardown can lead to memory corruption or kernel instability on systems using Renesas USB host/peripheral hardware.
Critical Impact
A use-after-free condition in the kernel ISR path can cause kernel memory corruption, system crashes, or potential privilege escalation on affected Linux systems during USB device removal.
Affected Products
- Linux kernel versions containing the renesas_usbhs driver prior to the fix commits
- Systems using Renesas USB host controller hardware
- Linux distributions shipping the unpatched drivers/usb/renesas_usbhs subsystem
Discovery Timeline
- 2026-05-08 - CVE-2026-43426 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43426
Vulnerability Analysis
The vulnerability is a [CWE-416] use-after-free condition in the renesas_usbhs USB driver. During device removal, usbhs_remove() proceeds to free driver-owned resources, including the pipe array allocated for USB endpoint management. At the time this occurs, the usbhs_interrupt handler is still registered with the kernel interrupt subsystem. If hardware raises an interrupt between the call to usbhs_pipe_remove() and full driver unbind, the ISR executes against freed memory regions.
The upstream fix reorders teardown so that devm_free_irq() is invoked before freeing pipe resources. This guarantees the interrupt handler is unregistered and any in-flight ISR execution completes before pipe memory is released. Exploitation requires the ability to trigger driver unbind alongside USB interrupt activity, typically requiring local access or physical USB interaction.
Root Cause
The root cause is improper ordering of resource deallocation relative to interrupt handler deregistration. The driver freed memory referenced by the ISR before calling devm_free_irq(), leaving a window where the interrupt handler could access stale pointers. Kernel interrupt deregistration synchronizes with running ISR instances, so calling devm_free_irq() first eliminates the race.
Attack Vector
Triggering this condition requires inducing driver removal while USB interrupts are active on Renesas USB hardware. A local attacker with the ability to unbind the driver, combined with USB traffic generating interrupts, could provoke the use-after-free. The vulnerability is not network-reachable and depends on hardware-specific conditions, limiting remote exploitability.
No verified public proof-of-concept code is available. The vulnerability mechanism is documented in the upstream kernel commits referenced below. See the Kernel Git Commit 51afaf9 for the corrective patch.
Detection Methods for CVE-2026-43426
Indicators of Compromise
- Kernel oops or panic messages referencing usbhs_interrupt, usbhs_pipe, or renesas_usbhs symbols
- KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the renesas_usbhs module during USB device removal
- Unexpected system crashes correlated with USB device hot-unplug or driver unbind events
Detection Strategies
- Audit running kernel version against the fixed commits published on git.kernel.org/stable
- Enable KASAN in test or staging kernels to surface use-after-free conditions in USB driver paths
- Review dmesg output for ISR-related faults occurring during echo unbind operations on USB controller sysfs entries
Monitoring Recommendations
- Collect kernel logs centrally and alert on oops, BUG, or KASAN reports referencing USB subsystem symbols
- Track package versions of distribution kernels to confirm deployment of the patched build
- Monitor systems with Renesas USB hardware for abnormal reboots or kernel taints
How to Mitigate CVE-2026-43426
Immediate Actions Required
- Identify Linux systems running kernels with the renesas_usbhs driver, particularly Renesas R-Car and RZ platform deployments
- Apply the upstream stable kernel update containing the reordered devm_free_irq() call
- Restrict local access to systems that cannot be immediately patched, since exploitation requires local interaction with the USB driver
Patch Information
The fix has been merged into multiple Linux stable trees. Refer to the following commits: Kernel Git Commit 0b7d11f, Kernel Git Commit 1899eda, Kernel Git Commit 3cbc242, Kernel Git Commit 51afaf9, Kernel Git Commit 6287e0c, Kernel Git Commit 6ffe44f, Kernel Git Commit 9c6159d, and Kernel Git Commit c7012fc. Update to the corresponding distribution kernel package once available.
Workarounds
- Blacklist the renesas_usbhs kernel module on systems where the Renesas USB controller is not in use
- Avoid runtime unbinding of the renesas_usbhs driver on production systems until the patch is applied
- Limit local user access and restrict permissions on USB sysfs unbind interfaces to prevent unprivileged driver detach
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
