CVE-2026-90215 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
mtd: ubi: Release device reference on busy detach
ubi_detach_mtd_dev() obtains a device reference through ubi_get_device() before checking whether the UBI device is busy. The busy return path drops ubi->ref_count but leaves the device reference held, so the device object cannot be released after a later detach.
Drop the device reference before returning -EBUSY.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel's MTD UBI subsystem represents a resource management flaw within the device detachment logic. Specifically, the function ubi_detach_mtd_dev is responsible for handling the removal of an Unsorted Block Images volume from a Memory Technology Device. During this process, the code invokes ubi_get_device to acquire a reference count on the underlying device structure, ensuring that the object remains valid while operations are performed upon it. However, when the system detects that the UBI device is currently busy and cannot be detached immediately, the error handling path attempts to clean up by decrementing the internal ref_count of the ubi volume structure but fails to release the previously acquired device reference. This asymmetry in resource acquisition and release creates a classic reference count leak where the kernel retains an unnecessary hold on the hardware device object even though the detachment operation has failed or been aborted due to active usage constraints.
From a technical perspective, this flaw constitutes an improper cleanup mechanism that leads to persistent memory and resource leaks within the kernel space. Because the device reference is never released in the busy error path, the total reference count for the MTD device remains artificially elevated. Over time, if such detach attempts are triggered repeatedly or under specific workload conditions where devices frequently become busy during detachment requests, this leak can accumulate. The primary operational impact of this issue is that it prevents the kernel from properly releasing and reusing hardware resources. In severe cases, particularly in systems with limited memory or those running many dynamic storage operations, this could contribute to resource exhaustion, potentially leading to system instability or denial of service conditions where new devices cannot be initialized because existing ones are incorrectly marked as still referenced by detached volume structures.
This type of vulnerability is categorized under CWE-401, which describes a missing release of memory after effective usage, and more specifically relates to improper cleanup procedures that leave resources in an inconsistent state. In the context of the MITRE ATT&CK framework, this aligns with techniques related to resource exhaustion or persistence through kernel-level manipulation, although it is primarily a stability issue rather than a direct exploitation vector for privilege escalation. The flaw highlights the critical importance of symmetric reference counting practices in low-level system programming, where every acquisition must have a corresponding release regardless of the execution path taken during error handling.
To mitigate this vulnerability and prevent further resource leaks, developers must ensure that all code paths within ubi_detach_mtd_dev properly balance their calls to device reference functions. The specific fix involves modifying the busy return path to explicitly drop the device reference obtained via ubi_get_device before returning the -EBUSY error code. This ensures that when a detachment fails due to active usage, both the internal volume state and the external hardware reference are correctly cleaned up, allowing the kernel to maintain accurate tracking of available resources. System administrators should apply the corresponding kernel patch or update their distribution's package repository to receive this fix, thereby restoring proper resource lifecycle management for UBI volumes on affected Linux systems.