Executive brief
The Linux kernel's MHI (Modem Host Interface) Endpoint driver has a bug in device initialization where not all reference counts are properly released if device setup fails. This can cause kernel memory leaks and prevent proper cleanup of hardware resources, potentially leading to system instability or resource exhaustion over time if errors occur repeatedly.
Technical details
The vulnerability is a reference count leak in the mhi_ep_create_device() function in drivers/bus/mhi/ep/main.c. The function acquires three device references (one initial from device_initialize(), one for the UL channel, and one for the DL channel), but the error path for dev_set_name() or device_add() failures only released a single reference, leaving two behind. This is triggered locally during device creation failure (no network attack vector). The fix routes both failure cases through a common error unwinding path that properly releases all three references before returning the error code.
Affected products
- Linux Linux kernel multiple versions (see git.kernel.org stable branches)
Timeline
- 2026-09-17: disclosed
- 2026-06-03: patched: Upstream commit 6f12862600bb70e599a614d706a095ea5f8f9858 by Yuho Choi; backported to stable branches