HIGH Introduced in 6.10
mhi Controller Leak
CVE-2026-90402
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix controller cleanup on EDL sysfs failure mhi_register_controller() adds the controller device before creating the optional trigger_edl sysfs file. If sysfs_create_file() fails, the error path only drops the device reference and leaves the device registered. Hence, call device_del() in the error path before put_device().
02KernelScan AI Analysis
Risk summary
Systems with MHI (Modem Host Interface) hardware — typically Qualcomm cellular modems connected via PCIe — are affected. An attacker who can cause memory pressure during controller registration could trigger an error path that leaves a stale device registered in sysfs. If the caller frees its controller data after the failed registration, subsequent userspace access to the lingering device can result in use-after-free, potentially leading to information disclosure, integrity corruption, or kernel panic.
Vulnerability analysis
While registering a modem controller, the driver publishes the device to userspace before creating an optional emergency-download sysfs file. If that file creation fails, the cleanup path drops the device without unpublishing it, leaving a stale entry in the kernel's device listings. Because the caller may discard its own data after the failed registration, later access to that lingering device through sysfs can read or write freed memory. The corrected cleanup now withdraws the device from the system before finishing cleanup. Reaching this flaw requires PCIe-connected MHI modem hardware and an unprivileged local user able to apply memory pressure during the brief registration window.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.10 | 6.12.110 | 7943dc67250f |
| 6.18 | 6.10 | 6.18.52 | 4fb17a7c437f |
| 7.2 | 6.10 | 7.2.6 | 4743959aa8d8 |
| mainline | 6.10 | 7.3 | 0d5b9e66591d |
| cip/6.12 | 6.10 | 6.12.111-cip32 | 7943dc67250f |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |