CVE-2026-93136 in Linux
Summary
by MITRE • 09/18/2026
In the Linux kernel, the following vulnerability has been resolved:
bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation
mhi_ep_create_device() takes one device reference for the UL channel and another for the DL channel after allocating the transfer device. These references are normally released by mhi_ep_destroy_device() before the device itself is removed.
If dev_set_name() or device_add() fails, the error path currently drops only one reference. The remaining channel references keep the device from being released and leave the channels associated with a device that was never registered.
Route both failures through a common unwind path that drops the DL channel reference, the UL channel reference, and the initial reference from device_initialize().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The Linux kernel's Mobile Interface Host (MHI) subsystem manages communication between host processors and remote devices, such as modems or accelerators, over various bus interfaces. A critical resource management flaw was identified within the MHI endpoint driver during the initialization phase of a new device instance. Specifically, the function mhi_ep_create_device() is responsible for allocating memory and initializing references to both uplink (UL) and downlink (DL) channels associated with the transfer device. Under normal operational conditions, these references are properly released by the cleanup routine mhi_ep_destroy_device() before the device structure itself is deallocated. However, a logic error in the error handling path creates a scenario where resource leaks occur if specific initialization functions fail during the setup process.
The technical flaw arises when either dev_set_name(), which assigns a unique name to the device object for sysfs visibility and identification, or device_add(), which registers the device with the kernel's core device model subsystem, returns an error code. In these failure scenarios, the existing error handling logic only releases one of the channel references. This oversight leaves at least one reference count unreleased, preventing the kernel from freeing the associated memory structures for that channel. Consequently, the MHI endpoint driver retains a dangling pointer to resources belonging to a device object that was never successfully registered in the system hierarchy. This results in a persistent device refcount leak, where allocated memory is effectively orphaned and inaccessible for reuse until the next reboot or module unload.
From an operational impact perspective, this vulnerability leads to progressive kernel memory exhaustion over time if the error condition can be triggered repeatedly. While dev_set_name() failures are rare due to their simplicity, device_add() failures can occur under conditions of high system load, resource constraints, or specific hardware states that prevent successful registration with the driver model core. Each occurrence increments the leak by one unreleased reference per channel involved in the failed creation attempt. Over extended periods or during stress testing scenarios involving frequent device hot-plugging or initialization retries, these accumulated leaks can contribute to overall memory pressure and potentially lead to out-of-memory conditions affecting other kernel subsystems. Furthermore, the presence of channels associated with an unregistered device represents a state inconsistency that could complicate debugging efforts and obscure the true health status of the MHI bus infrastructure.
To mitigate this vulnerability, the fix implements a unified error handling strategy known as an unwind path. Instead of having separate cleanup logic for each potential failure point within mhi_ep_create_device(), both dev_set_name() and device_add() errors now route through a single common exit routine. This centralized approach ensures that all acquired references are systematically released in reverse order of acquisition. Specifically, the DL channel reference is dropped first, followed by the UL channel reference, and finally the initial reference obtained from device_initialize(). By guaranteeing that every allocated resource is properly decremented regardless of which initialization step fails, this patch eliminates the refcount leak entirely. This change aligns with standard kernel coding practices for robust error handling in driver development, ensuring that partial failures do not leave the system in an inconsistent state.
This issue falls under CWE-401, which describes a missing release of memory after successful allocation, specifically manifesting as a resource leak due to improper cleanup on failure paths. In terms of attack vectors and defensive mapping, while this is primarily a reliability and stability issue rather than a direct security exploit vector for privilege escalation or remote code execution, it relates to CWE-404 which involves improper system shutdown handling leading to resource leaks. From an ATT&CK perspective, such vulnerabilities are often associated with T1539, Steal Web Session Cookie, in the context of long-term persistence through memory exhaustion if exploited in a denial-of-service manner against critical infrastructure components managed by MHI, though its primary classification remains within kernel stability and resource management integrity. The resolution ensures that the MHI endpoint driver adheres to strict reference counting protocols, maintaining system reliability during device initialization failures.