CVE-2026-93136: bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation
In the Linux kernel, the following vulnerability has been resolved:
bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation
mhiepcreatedevice() takes one device reference for the UL channel and another for the DL channel after allocating the transfer device. These references are normally released by mhiepdestroydevice() before the device itself is removed.
If devsetname() or deviceadd() fails, the error path currently drops only one reference. The remaining channel references keep the device from being released and leave the channels associated with a device that was never registered.
Route both failures through a common unwind path that drops the DL channel reference, the UL channel reference, and the initial reference from deviceinitialize().
Affected Software
Event History
Frequently Asked Questions
When can the leak occur?
It can occur when mhi_ep_create_device() fails at either dev_set_name() or device_add() after references have been acquired for the UL and DL channels.
What is left behind when the error path is triggered?
One or more channel references can remain held, preventing the device from being released. The channels may also remain associated with a device that was never registered.
What does the resolved error handling change?
Both failure cases use a common unwind path that releases the DL channel reference, UL channel reference, and the initial reference acquired by device_initialize().