Executive brief
The Linux kernel's UBI (Unsorted Block Images) subsystem contains a resource leak in its device detachment logic. When attempting to detach a UBI device that is in active use, the kernel fails to properly release an internal device reference, preventing the device object from being freed even after subsequent detach operations. While not immediately exploitable for privilege escalation, this resource leak could be leveraged to cause denial of service through memory exhaustion on systems managing flash storage.
Technical details
A resource leak exists in the ubi_detach_mtd_dev() function in drivers/mtd/ubi/build.c. The function obtains a device reference via ubi_get_device() and decrements the reference count; however, when the UBI device is found to be busy and the function returns -EBUSY (without the "anyway" flag), it fails to release the device reference via put_device() before returning. This causes the device object to remain held indefinitely. The vulnerability requires local access to trigger detach operations on active UBI devices. A patch was released adding a single put_device() call before the error return path. This is a low-severity fix addressing proper resource cleanup rather than a security boundary bypass.
Affected products
- Linux Linux kernel Multiple versions prior to patch (CVE-2026-90215 fix date 2026-08-07)
Timeline
- 2026-09-17: disclosed: CVE-2026-90215 published
- 2026-08-07: patched: Fix committed by Yuho Choi
- 2026-09-14: patched: Backport to stable kernels