Linux Kernel Vulnerability in Renesas PHY Driver for R-Car Gen3 USB2

CVE-2026-93276

What is CVE-2026-93276?

The vulnerability in the Renesas PHY driver within the Linux kernel occurs when the devm_regulator_get_exclusive() function initializes the regulator with an enable_count of 1. This design flaw requires consumers to disable the regulator before releasing it. If the regulator remains in its initial enabled state without a prior explicit enable call, the cleanup process may skip decrementing the enable_count, resulting in a warning during the release of the regulator upon device removal. The fix ensures that the devm disable action is always registered based on the current enabled state, which addresses both explicit enables and the initial state set by devm_regulator_get_exclusive().

References