CVE-2026-43426 Linux CVE debrief

Who should care

Linux kernel maintainers, distribution security teams, and operators of systems that include the renesas_usbhs driver in affected kernel branches. This is most relevant anywhere kernel updates are staged slowly or embedded/industrial deployments remain on older stable releases.

Technical summary

NVD classifies the issue as CWE-416 (use-after-free) with CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. According to the record, affected Linux kernel ranges span multiple stable branches: 3.0 through 5.10.252, 5.11 through 5.15.202, 5.16 through 6.1.166, 6.2 through 6.6.129, 6.7 through 6.12.77, 6.13 through 6.18.18, 6.19 through 6.19.8, plus 7.0-rc1 through 7.0-rc4. The described fix is to call devm_free_irq() before usbhs_pipe_remove(), ensuring the IRQ handler is disabled and any running ISR completes before the driver frees the pipe array and related resources.

Defensive priority

High. The issue is locally reachable, but it affects kernel memory safety and carries high confidentiality, integrity, and availability impact in the CVSS record. Prioritize upgrades on systems that ship or use the affected driver.

Recommended defensive actions

• Upgrade to a fixed kernel release in the affected branch line: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.19, or 6.19.9, as appropriate for your branch.
• Apply the referenced stable kernel patches from the official kernel.org links if you maintain downstream kernels.
• Confirm whether your hardware and kernel configuration actually use the renesas_usbhs driver, then prioritize those hosts for remediation.
• Track device-removal and hot-unplug test paths in validation, because the vulnerable path is in usbhs_remove() and interrupt teardown ordering.
• If immediate patching is not possible, reduce exposure by limiting local administrative access on affected hosts and accelerating kernel maintenance windows.

Evidence notes

This debrief is based only on the supplied NVD record and official kernel.org patch references. The record lists the issue as analyzed, assigns CWE-416, and provides the CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The source description explicitly states the removal-time ISR use-after-free and the fix order change involving devm_free_irq() before freeing resources. NVD also supplies vulnerable CPE ranges and patch references on git.kernel.org.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.