High 7.0Published Sep 17, 2026

CVE-2026-90402bus: mhi: host: Fix controller cleanup on EDL sysfs failure

Updated under an hour ago (Oct 26, 2026, 5:30 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix controller cleanup on EDL sysfs failure mhi_register_controller() adds the controller device before creating the optional trigger_edl sysfs file. If sysfs_create_file() fails, the error path only drops the device reference and leaves the device registered. Hence, call device_del() in the error path before put_device().

CVSS: 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	17553ba8e19dee8770b3dcc597d49dcc3418f3b0 builds before 7943dc67250fad6ceac0dd089c6ad5776e4be71d; 17553ba8e19dee8770b3dcc597d49dcc3418f3b0 builds before 4fb17a7c437f145353e93e6a9791f6db70e1cc63; from 17553ba8e19dee8770b3dcc597d49dcc3418f3b0 before 4743959aa8d876b5b456a62e8a62eb770db7afe9; 17553ba8e19dee8770b3dcc597d49dcc3418f3b0 builds before 0d5b9e66591d4e2a4376ac82c8cda889a29ba3ee	CNA record

References

References

https://git.kernel.org/stable/c/7943dc67250fad6ceac0dd089c6ad5776e4be71d
https://git.kernel.org/stable/c/4fb17a7c437f145353e93e6a9791f6db70e1cc63
https://git.kernel.org/stable/c/4743959aa8d876b5b456a62e8a62eb770db7afe9
https://git.kernel.org/stable/c/0d5b9e66591d4e2a4376ac82c8cda889a29ba3ee

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.