Executive brief
The Linux kernel's UBI (Unsorted Block Images) subsystem contains a logic error in its module initialization rollback procedure. When UBI devices are attached with explicit device numbers, the rollback code fails to properly clean up all successfully-attached devices during error recovery, potentially leaving stale device state in memory that could interfere with subsequent operations or system stability.
Technical details
The vulnerability exists in the ubi_init_attach() function's error handling path. The rollback logic iterates through ubi_devices[] array using the mtd= parameter index as the loop bound, which assumes parameter indices match UBI device numbers. This assumption breaks when explicit ubi_num values are specified via the mtd.ubi command line, causing successfully-attached devices stored at higher array indices to be skipped during cleanup. An attacker with local boot-time control over kernel command-line parameters could exploit this to leave UBI devices attached, potentially causing memory leaks or device state corruption. The fix changes the rollback loop to scan the full UBI_MAX_DEVICES range and detach using actual array indices rather than stored device numbers.
Affected products
- Linux Linux Kernel Affected by commit 83ff59a06663 onwards; patched in upstream commit 5b0a6b554e12a97f9771a9a9f4ea1f5457373c73
Timeline
- 2026-06-08: other: Patch authored by Yuho Choi
- 2026-09-14: patched: Patch merged to stable branches by Greg Kroah-Hartman
- 2026-09-17: disclosed: CVE-2026-90216 published