CVE-2026-90215: mtd: ubi: Release device reference on busy detach
In the Linux kernel, the following vulnerability has been resolved:
mtd: ubi: Release device reference on busy detach
ubidetachmtddev() obtains a device reference through ubigetdevice() before checking whether the UBI device is busy. The busy return path drops ubi->refcount but leaves the device reference held, so the device object cannot be released after a later detach.
Drop the device reference before returning -EBUSY.
Affected Software
Event History
Frequently Asked Questions
When can this issue be triggered?
It is triggered when UBI attempts to detach an MTD device while that UBI device is busy. The affected busy-detach return path leaves a device reference held.
What is the impact of a failed detach?
The device object may remain unreleased even after a later detach, because the earlier busy-detach path leaked its device reference.
How can I tell whether a system has encountered the issue?
The available information identifies the condition as a busy UBI detach followed by a later detach where the device object cannot be released. It does not provide a specific log message, observable indicator, or detection command.
What is the remediation?
Apply a Linux kernel update containing the fix that drops the device reference before returning -EBUSY from the busy detach path.