Cloudanix VulnDB

CVE-2026-93136

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug can leave small amounts of memory unfreed when certain device setup steps fail, potentially causing gradual resource drain on affected systems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Medium

What it actually does

Reference count leak in mhi_ep_create_device error path leaves UL/DL channel references and device structure unreleased when dev_set_name or device_add fails, preventing normal cleanup by mhi_ep_destroy_device.

Why it matters to the business

Long-term kernel memory pressure or resource leaks on systems using MHI endpoint functionality, increasing operational risk of instability in embedded or mobile Linux deployments.

How an attack unfolds

An attacker with ability to induce device creation failures (local code execution or malicious peripheral) repeatedly triggers the incomplete unwind, accumulating leaked references that keep channel objects alive after the parent device is gone.

How to fix it

Apply the upstream fix that consolidates error handling into a single unwind path dropping the DL reference, UL reference, and initial device_initialize reference.

How to confirm the fix worked

Inspect the mhi_ep_create_device function for the unified error label that releases all three references; confirm the patch is present via kernel source or git log.

Typical attack path

  1. Cause dev_set_name or device_add to fail during mhi_ep_create_device
  2. Observe only partial reference drop on the error path
  3. Accumulate unreleased channel references over multiple attempts

How to detect it

Search kernel logs and slabinfo or kmemleak reports for orphaned MHI channel objects or devices that were never added; correlate with MHI bus initialization failures.

What your security team should do

  • Prioritize kernel updates containing the MHI endpoint refcount fix on affected distributions
  • Audit custom MHI endpoint drivers for similar error-path reference handling
  • Monitor memory usage statistics on MHI-enabled devices for unexpected growth

The record

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation mhi_ep_create_device() takes one device reference for the UL channel and another for the DL channel after allocating the transfer device. These references are normally released by mhi_ep_destroy_device() before the device itself is removed. If dev_set_name() or device_add() fails, the error path currently drops only one reference. The remaining channel references keep the device from being released and leave the channels associated with a device that was never registered. Route both failures through a common unwind path that drops the DL channel reference, the UL channel reference, and the initial reference from device_initialize().

Affected packages

Ecosystem Package Introduced Fixed