CVE-2026-90288: phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-17 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure for_each_child_of_node_scoped() releases the node reference on scope exit, so the explicit of_node_put(np) in the devm_phy_create() error path drops it twice. Drop the redundant of_node_put() and let the scoped cleanup handle it.

Affected products

Linux kernel: 7.0 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 7.3. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/5374f3d53376d35085e0727c8c1b945bf7123996
https://git.kernel.org/stable/c/b780b8929c759cfa7a892d58625a5ad46cb1cbd2

Get alerted when CVE-2026-90288 or the next vulnerability affects your stack