The bug resides in the Renesas R-Car Gen3 USB2 driver within the Linux kernel. The driver calls devm_regulator_get_exclusive(), which initializes the regulator with an enable counter of one. The device manager is expected to register a cleanup routine that decrements this counter when the device is removed. However, the cleanup routine was only registered when the caller explicitly enabled the VBUS regulator. When the regulator remained in its initial enabled state without an explicit enable call, the cleanup path never decremented the counter, causing a WARN_ON during regulator release. The failure to decrement the counter leaves the regulator in an invalid state and can cause driver mis‑behavior and system instability.

This issue is contained entirely in the Linux kernel’s core regulator framework as exercised by the Renesas R-Car Gen3 USB2 driver. Any Linux distribution that ships a kernel containing this driver or a derivative that relies on the same regulator logic is affected. No specific vendor version numbers are supplied, so the vulnerability exists in all builds prior to the commit that introduced the fix.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. There are no publicly known exploits. The flaw requires local or privileged access to trigger a device removal of the affected hardware and does not provide code execution, privilege escalation, or data compromise. Consequently, the overall risk is low, but the instability caused by warnings or potential driver crashes could impact availability in critical environments.