Executive brief
The Linux kernel's Modem Host Interface (MHI) host controller registration process fails to properly clean up device state when sysfs file creation encounters an error. This leaves a registered device object in memory without proper cleanup, potentially leading to resource exhaustion or memory leaks on systems that encounter EDL sysfs initialization failures.
Technical details
The vulnerability exists in the mhi_register_controller() function in drivers/bus/mhi/host/init.c. The function registers a controller device and then attempts to create an optional sysfs trigger_edl file. If sysfs_create_file() fails, the error handling path only calls put_device() to drop the device reference, but fails to call device_del() to properly unregister the device first. This causes the device to remain registered in the kernel's device tree while its reference count is decremented, leading to a resource leak. The fix adds an err_del_dev label that calls device_del() before put_device() when sysfs file creation fails. This is a local vulnerability requiring kernel module loading/device initialization capabilities, with patches available in upstream Linux.
Affected products
- Linux Linux kernel multiple versions prior to fix commit 0d5b9e66591d4e2a4376ac82c8cda889a29ba3ee
Timeline
- 2026-09-17: disclosed: CVE-2026-90402 published
- 2026-07-30: patched: Fix commit 0d5b9e66591d4e2a4376ac82c8cda889a29ba3ee merged by Manivannan Sadhasivam