CVE-2026-90288phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure for_each_child_of_node_scoped() releases the node reference on scope exit, so the explicit of_node_put(np) in the devm_phy_create() error path drops it twice. Drop the redundant of_node_put() and let the scoped cleanup handle it.
- CVSS
- 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b64b32791fb557f922beebddf74c47baf338cef0 before 5374f3d53376d35085e0727c8c1b945bf7123996; from b64b32791fb557f922beebddf74c47baf338cef0 before b780b8929c759cfa7a892d58625a5ad46cb1cbd2 | CNA record |
References
- https://git.kernel.org/stable/c/5374f3d53376d35085e0727c8c1b945bf7123996
- https://git.kernel.org/stable/c/b780b8929c759cfa7a892d58625a5ad46cb1cbd2
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.