CVE-2026-43426

In the Linux kernel, the following vulnerability has been resolved:

usb: renesas_usbhs: fix use-after-free in ISR during device removal

In usbhsremove(), the driver frees resources (including the pipe array) while the interrupt handler (usbhsinterrupt) is still registered. If an interrupt fires after usbhspiperemove() but before the driver is fully unbound, the ISR may access freed memory, causing a use-after-free.

Fix this by calling devmfreeirq() before freeing resources. This ensures the interrupt handler is both disabled and synchronized (waits for any running ISR to complete) before usbhspiperemove() is called.