CVE-2026-43294

What it actually does

This is a local denial-of-service flaw in the Linux kernel Renesas RZ/G2L display pipeline, specifically the DRM MIPI-DSI host driver. On affected systems with certain MIPI-DSI panels, the driver stops the MIPI-DSI interface before panel shutdown callbacks finish sending required display-off commands. When the panel driver later attempts a MIPI-DSI transfer during unprepare(), the stopped interface can trigger a synchronous external abort/kernel panic. The practical technical result is a kernel crash during reboot, shutdown, or display disable sequencing on affected hardware configurations.

Why it matters to the business

Affected embedded Linux systems, industrial devices, appliances, kiosks, automotive/IoT platforms, or other products using Renesas RZ/G2L display hardware may crash during reboot or display power-down. This can cause failed maintenance windows, device unavailability, watchdog-triggered recovery loops, field-service incidents, and reduced reliability for products that depend on controlled restart behavior. The vulnerability is not known to be remotely exploitable, is not in CISA KEV, and has very low EPSS, so urgency is primarily highest for organizations operating affected Renesas-based devices where local users or management functions can trigger reboot or display state changes.

How an attack unfolds

An attacker needs local access or another permitted path to trigger reboot, shutdown, or display disable behavior on an affected Renesas RZ/G2L Linux system using a susceptible MIPI-DSI panel. During the shutdown sequence, the DRM stack disables the display pipeline. For some panels, the panel driver's unprepare() routine sends MIPI-DSI commands such as display-off commands. In vulnerable kernels, the Renesas MIPI-DSI interface may already be stopped when those commands are issued. The resulting transfer through rzg2l_mipi_dsi_host_transfer() can cause a kernel panic, denying service until the device reboots or is manually recovered. There is no indication from the provided data of public exploit maturity, remote code execution, privilege escalation, ransomware use, or active KEV exploitation.

How to fix it

Update to a Linux kernel build that includes the upstream fix for the Renesas RZ/G2L DRM MIPI-DSI shutdown ordering issue. The fix moves rzg2l_mipi_dsi_stop() into the atomic post-disable path so panel unprepare() commands complete before the MIPI-DSI interface is stopped. Because no exact fixed kernel versions were provided, use the latest supported vendor BSP, distribution kernel, long-term stable kernel, or Renesas platform kernel that has backported the relevant DRM Renesas rz-du mipi_dsi fix. Where immediate patching is not possible, restrict local shell and reboot/shutdown privileges, limit access to display power-management controls, avoid unnecessary remote-triggered reboot workflows on affected devices, and validate watchdog/recovery behavior to prevent persistent reboot loops.

How to confirm the fix worked

Confirm exposure by checking whether the system uses Renesas RZ/G2L/RZ-family display hardware and loads the rzg2l MIPI-DSI DRM driver. Review the running kernel or vendor BSP changelog for the fix that moves rzg2l_mipi_dsi_stop() to rzg2l_mipi_dsi_atomic_post_disable(). On a patched test device with an affected panel, perform controlled reboot and display disable tests and verify the system cleanly restarts without a kernel panic or stack trace involving rzg2l_mipi_dsi_host_transfer(), mipi_dsi_device_transfer(), drm_panel_unprepare(), or the panel unprepare callback. Validate using serial console logs, persistent journal logs, pstore/ramoops, and kernel crash logs where available.

Typical attack path

1. Obtain local access to an affected Linux system or access to a function that can trigger reboot, shutdown, or display power-state transitions.
2. Confirm the system uses the Renesas RZ/G2L DRM MIPI-DSI driver with a panel that sends MIPI-DSI commands during its unprepare() callback.
3. Trigger reboot, shutdown, or display disable sequencing.
4. The kernel stops the MIPI-DSI interface before the panel finishes sending required shutdown commands.
5. A subsequent MIPI-DSI host transfer occurs while the interface is stopped.
6. The kernel hits a synchronous error path and panics, causing denial of service.

How to detect it

Look for evidence of kernel panics or abnormal reboots during shutdown, reboot, or display power-down events. Useful sources include serial console output, kernel ring buffer logs, persistent systemd-journal logs from the previous boot, /var/log/kern.log, /var/log/messages, pstore/ramoops records under /sys/fs/pstore, crash dumps, watchdog reset logs, and device management telemetry showing unexpected reboot loops. Focus searches on call traces containing Renesas RZ/G2L MIPI-DSI functions, generic MIPI-DSI transfer functions, DRM panel unprepare paths, and panel-specific unprepare callbacks such as ili9881c_unprepare. Because this is a local denial-of-service issue, exploitation evidence may look identical to accidental triggering during legitimate reboot or maintenance; correlate crash timing with user sessions, local command execution, remote management actions, scheduled reboots, firmware updates, or application actions that disable the display.

• rzg2l_mipi_dsi_host_transfer
• mipi_dsi_device_transfer
• mipi_dsi_dcs_set_display_off_multi
• ili9881c_unprepare
• drm_panel_unprepare
• do_serror
• el1h_64_error_handler
• el1h_64_error
• systemd-shutdown[1]: Rebooting.
• rzg2l-mipi-dsi 10850000.dsi
• rzg2l_mipi_dsi_atomic_disable(): entry
• rzg2l_mipi_dsi_atomic_post_disable(): entry
• ili9881c-dsi 10850000.dsi.0
• ili9881c_unprepare(): entry
• Call trace:
• Kernel panic
• reboot: Restarting system
• /sys/fs/pstore
• /var/log/kern.log
• /var/log/messages

What your security team should do

• Inventory Linux-based products and systems using Renesas RZ/G2L display hardware or the rzg2l MIPI-DSI driver.
• Prioritize patching for devices where local users, field operators, remote management systems, or application workflows can trigger reboot, shutdown, or display power-state transitions.
• Upgrade affected systems to a vendor-supported kernel or BSP containing the Renesas DRM MIPI-DSI shutdown sequencing fix.
• Until patched, restrict local user privileges for reboot/shutdown and limit access to interfaces that can disable the display pipeline.
• Enable persistent kernel logging such as journald persistence, serial console capture, netconsole, pstore, or ramoops on embedded devices to preserve crash evidence across reboots.
• Search historical logs for kernel panic traces involving rzg2l_mipi_dsi_host_transfer and related MIPI-DSI panel unprepare functions.
• Test patched images on representative hardware panels before broad deployment because the issue is panel-sequence dependent.
• Document expected recovery behavior for affected devices, including watchdog timeout, reboot completion, and manual recovery procedures.