CVE-2026-90402 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
bus: mhi: host: Fix controller cleanup on EDL sysfs failure
mhi_register_controller() adds the controller device before creating the optional trigger_edl sysfs file. If sysfs_create_file() fails, the error path only drops the device reference and leaves the device registered.
Hence, call device_del() in the error path before put_device().
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within the Linux kernel's Mobile Interface Host (MHI) subsystem represents a resource management flaw stemming from an inconsistent state during controller initialization. Specifically, the issue resides in the mhi_register_controller function, which is responsible for setting up the hardware interface between the host processor and the modem or other MHI-compliant devices. During this registration process, the kernel first registers the controller device with the system's device model infrastructure by invoking device_add(). This action makes the device visible to userspace and allows it to receive events and manage resources. Subsequently, the function attempts to create an optional sysfs file named trigger_edl, which is used to manually trigger Emergency Download Mode on connected devices for firmware updates or recovery operations. The critical flaw occurs when the creation of this sysfs entry fails due to errors such as memory allocation failures or permission issues. In the original implementation, the error handling path only executed put_device(), which decrements the reference count of the device structure but does not remove the device from the system's global lists or notify userspace that the device is no longer available.
This incomplete cleanup results in a partially initialized and registered device remaining active within the kernel despite the failure to fully configure its interface with userspace. Because the device remains registered, it can be accessed by user-space applications through sysfs entries that may not function correctly or at all since the underlying trigger_edl file was never created. This inconsistency violates the principle of atomicity in system configuration and leaves the subsystem in an undefined state where a device appears present but lacks critical functionality. Such states are particularly dangerous as they can lead to race conditions, use-after-free scenarios if other parts of the kernel assume full initialization based on registration status, or confusion for management tools that rely on accurate device presence information. The flaw essentially creates a zombie-like object in the driver model that consumes resources and potentially exposes incomplete interfaces without proper safeguards.
From an operational impact perspective, this vulnerability can lead to system instability when administrators or automated scripts attempt to interact with the MHI controller after a failed initialization sequence. If user-space tools query for available devices, they may detect the partially registered controller and attempt operations that assume full functionality, leading to kernel panics or undefined behavior due to missing data structures associated with the uncreated sysfs file. Furthermore, repeated attempts to register controllers in environments where sysfs creation frequently fails could lead to resource leaks over time, as each failed registration leaves behind a device object that is not fully cleaned up from the system's perspective. This degrades system reliability and complicates troubleshooting efforts, as the presence of non-functional devices can mask other issues or interfere with proper hardware enumeration processes essential for mobile broadband and IoT connectivity solutions built on MHI technology.
The remediation involves modifying the error handling logic within mhi_register_controller to ensure that if sysfs_create_file() fails, the device is properly unregistered from the system before releasing its reference count. By calling device_del() prior to put_device(), the kernel ensures that all internal lists are updated, userspace notifications are sent indicating the removal of the device, and any associated resources tied to the registration process are correctly released. This aligns with standard practices for driver development in Linux, where every successful call to device_add must be matched by a corresponding device_del on failure paths to maintain consistency between the kernel's internal state and the visible system configuration.
This vulnerability is categorized under CWE-401, which describes a missing release of memory or other resources after allocation, specifically focusing here on the incomplete cleanup leading to an inconsistent object state rather than just simple memory leakage. It also relates to CWE-823, involving use of objects with multiple references when one reference has not been properly released, as the device structure remains referenced while being in a broken state. In terms of attack vectors and defensive mapping, this type of flaw is relevant to ATT&CK technique T1059, Command and Scripting Interpreter, if an attacker could exploit the inconsistent state to manipulate system behavior through sysfs interactions, although primarily it serves as a stability risk rather than a direct privilege escalation vector. Mitigation strategies involve applying kernel patches that correct this initialization sequence, ensuring robust error handling in driver code. System administrators should ensure their kernels are updated with fixes addressing MHI subsystem registration errors and monitor for any anomalies related to device enumeration failures or unexpected behavior during modem attachment processes.