OCTOBER 12, 2026
Live Feed
Back to database
Case File

CVE-2026-90402

HIGH · CVSS 7 EPSS 0.15%

Source: NVD + CISA KEV + EPSS · Published 2026-09-17 · Last synced 2026-10-12

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's MHI (Mobile Host Interface) subsystem, specifically during the registration of controller devices when the creation of the trigger_edl sysfs file fails. This oversight can lead to a situation where a device remains registered despite an error, potentially causing resource leaks or inconsistent device states. Linux system administrators and developers working with MHI devices should prioritize addressing this issue to ensure proper device management and system stability.

CVE
CVE-2026-90402
Severity
HIGH
CVSS
7
EPSS
0.15%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix controller cleanup on EDL sysfs failure mhi_register_controller() adds the controller device before creating the optional trigger_edl sysfs file. If sysfs_create_file() fails, the error path only drops the device reference and leaves the device registered. Hence, call device_del() in the error path before put_device().