CVE-2026-90288

HighCVSS 7.4/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure

for_each_child_of_node_scoped() releases the node reference on scope exit, so the explicit of_node_put(np) in the devm_phy_create() error path drops it twice.

Drop the redundant of_node_put() and let the scoped cleanup handle it.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= b64b32791fb557f922beebddf74c47baf338cef0, < 5374f3d53376d35085e0727c8c1b945bf7123996; >= b64b32791fb557f922beebddf74c47baf338cef0, < b780b8929c759cfa7a892d58625a5ad46cb1cbd2
LinuxLinux7.0

References

Timeline

Published
Sep 17, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-902897.8In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Resize MST HDCP per-connector arrays to 32 AMDGPU_DM_CVE-2026-90295.4A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variaCVE-2026-90290In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Restore DAIF state on error Sashiko AI has reported CVE-2026-902917.8In the Linux kernel, the following vulnerability has been resolved: module/dups: Fix use-after-free in kmod_dup_req lifetime handling The CVE-2026-902927.8In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix use-after-free in siw_accept() siw_accept() looks up theCVE-2026-902937.5In the Linux kernel, the following vulnerability has been resolved: IB/isert: post the full-feature receive buffers after session registratCVE-2026-902947.5In the Linux kernel, the following vulnerability has been resolved: IB/isert: delay the final Login Response until the session is registereCVE-2026-90295In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix out-of-bounds write when probed more than once imxCVE-2026-90296In the Linux kernel, the following vulnerability has been resolved: cpufreq: imx6q: fix devres accumulation across driver rebind imx6_soc_CVE-2026-90297In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: crtc: Propagate layer initialization error sun4i_crtc_init(CVE-2026-90298In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: tcon: Drop TCON TOP device reference of_find_device_by_nodeCVE-2026-90299In the Linux kernel, the following vulnerability has been resolved: bpf: Fix sleepable check for tracing/lsm prog When CONFIG_FUNCTION_ERR
CVE-2026-90288: High severity, CVSS 7.4 | Vulnix