CVE-2026-90288: Linux

High severity, CVSS 7.4. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure for_each_child_of_node_scoped() releases the node reference on scope exit, so the explicit of_node_put(np) in the devm_phy_create() error path drops it twice. Drop the redundant of_node_put() and let the scoped cleanup handle it.

Affected products

• Linux Linux: from 7.0, before 7.2.6 (fixed in 7.2.6)

Published 2026-09-17. Last modified 2026-09-18.