VulnerabilityPublished 24 Sep 2026Updated 19 Oct 2026

CVE-2026-93276: Linux kernel · phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in bf7fefbc26e292c08cfe7b6496b879109ef1475a : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Low

Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in bf7fefbc26e292c08cfe7b6496b879109ef1475a, 935f6e837a83b86b073a7601f699dc2c00e01322, 49c9b71b45081e5e5eeb507a2d6edb80d332dc59

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to bf7fefbc26e292c08cfe7b6496b879109ef1475a, 935f6e837a83b86b073a7601f699dc2c00e01322 or 49c9b71b45081e5e5eeb507a2d6edb80d332dc59.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 24843404efe47eab1ee88d7475a0be0f2f6fd9db, < bf7fefbc26e292c08cfe7b6496b879109ef1475a	Fixed in bf7fefbc26e292c08cfe7b6496b879109ef1475a
LinuxLinux	Affected ≥ 24843404efe47eab1ee88d7475a0be0f2f6fd9db, < 935f6e837a83b86b073a7601f699dc2c00e01322	Fixed in 935f6e837a83b86b073a7601f699dc2c00e01322
LinuxLinux	Affected ≥ 24843404efe47eab1ee88d7475a0be0f2f6fd9db, < 49c9b71b45081e5e5eeb507a2d6edb80d332dc59	Fixed in 49c9b71b45081e5e5eeb507a2d6edb80d332dc59
LinuxLinux	Affected =6.11	Fixed in–

AI-suggested

A fix is available in the Linux kernel versions identified by commits bf7fefbc26e292c08cfe7b6496b879109ef1475a, 935f6e837a83b86b073a7601f699dc2c00e01322, and 49c9b71b45081e5e5eeb507a2d6edb80d332dc59. Users should update to these fixed kernel versions to resolve the issue.

Description

A vulnerability in the Linux kernel's Renesas phy-rcar-gen3-usb2 driver related to devm action registration for a disabled VBUS regulator has been fixed. The issue involved improper handling of the regulator's enable count, causing a warning during device removal. The fix ensures the devm disable action is always registered based on the regulator's actual enabled state, preventing the warning and potential resource management issues.

Impact

The vulnerability causes a WARN_ON warning during device removal due to improper management of the regulator's enable count. This may lead to resource management warnings and potential instability during device cleanup but does not indicate direct security compromise or exploitation.

Summary

The Linux kernel's Renesas phy-rcar-gen3-usb2 driver used devm_regulator_get_exclusive() which initializes the regulator with enable_count = 1, requiring explicit disable before release. Previously, the devm disable action was only registered if the caller explicitly enabled the regulator. If the regulator was left enabled by default without an explicit enable call, the cleanup path skipped decrementing enable_count, triggering a WARN_ON during regulator release on device removal. The fix registers the devm disable action based on the actual enabled state via regulator_is_enabled(), covering both explicitly enabled and initially enabled cases.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 13:44 UTC

Technical details

References

Community reviews

Related threats