CVE-2026-90194: ACPI: scan: fix bus ID cleanup on device_add() failures
In the Linux kernel, the following vulnerability has been resolved:
ACPI: scan: fix bus ID cleanup on deviceadd() failures
When deviceadd() fails after acpidevicesetname() has allocated an instance ID and a new acpidevicebusid has been linked into acpibusidlist, the rollback path only removes wakeuplist and detaches the ACPI handle data.
That leaves the bus-ID bookkeeping behind and keeps the allocated instance number consumed.
Move the bus-ID cleanup and wakeup-list removal into a single helper.
Use it from both the normal device teardown path and the deviceadd() rollback path. The wakeup list node is initialized before registration, so it can be deleted without checking whether the device is wakeup- capable like in the original teardown path.
[ rjw: Rename acpidevicedellist() to acpidevicecleanup() ] [ rjw: Subject and changelog edits ]
Affected Software
Event History
Frequently Asked Questions
Under what condition does the stale bus-ID bookkeeping occur?
It occurs when ACPI device registration reaches acpi_device_set_name(), allocates an instance ID, and links a new bus ID, but device_add() subsequently fails. The previous rollback path did not remove that bus-ID entry or release the consumed instance number.
What is the practical effect of a failed device registration on an unpatched kernel?
The failed registration can leave stale ACPI bus-ID bookkeeping in acpi_bus_id_list and retain the allocated instance number. The rollback path also needs to remove the device from the wakeup list and detach its ACPI handle data.
What does the fix change in cleanup behavior?
The fix consolidates bus-ID cleanup and wakeup-list removal into a shared helper used by both normal device teardown and the device_add() failure rollback path. It removes the wakeup-list node without requiring a wakeup-capability check because the node is initialized before registration.