CVE-2026-90288

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the rcar-gen2 Renesas PHY driver where a double reference release occurs during PHY creation failure. The for each child of node scoped() function automatically releases the node reference upon scope exit; however, an explicit call to of node put(np) within the devm phy create() error path causes the reference to be dropped twice.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.