CVE-2026-90288

What it actually does

Double of_node_put on device tree node reference during phy creation failure in the rcar-gen2 phy driver causes use-after-free of the of_node structure.

Why it matters to the business

Kernel instability or potential local privilege escalation on Linux systems using affected Renesas R-Car Gen2 hardware, increasing crash risk and maintenance burden for embedded deployments.

How an attack unfolds

An attacker with local access crafts conditions that cause devm_phy_create to fail after for_each_child_of_node_scoped has acquired the node, triggering the redundant of_node_put and subsequent use-after-free when the node is later dereferenced.

How to fix it

Apply the upstream fix that removes the explicit of_node_put and relies on for_each_child_of_node_scoped cleanup; rebuild and deploy updated kernel images for all affected rcar-gen2 platforms.

How to confirm the fix worked

Inspect the rcar-gen2 phy driver source for removal of the redundant of_node_put call after devm_phy_create error handling; boot test systems with phy creation failure scenarios to confirm no double-release warnings or crashes occur.

Typical attack path

1. Obtain local code execution or shell access on target system
2. Trigger phy device creation failure path in rcar-gen2 driver via device tree manipulation or hardware state
3. Cause double release of of_node reference leading to UAF
4. Leverage freed node memory for arbitrary read/write or code execution

How to detect it

Search kernel logs and dmesg for reference count imbalance warnings or use-after-free crashes involving of_node or phy creation in rcar-gen2; examine crash dumps for double kobject_put patterns on device nodes.

What your security team should do

• Prioritize kernel updates for any Renesas R-Car Gen2 based devices in production or field deployments
• Review device tree configurations that could induce phy creation failures
• Monitor kernel logs for of_node reference count warnings on affected hardware