UBUNTU-CVE-2026-90194: Low severity ubuntu/linux-aws vulnerability
In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: fix bus ID cleanup on deviceadd() failures When deviceadd() fails after acpidevicesetname() has allocated an instance ID and a new acpidevicebusid has been linked into acpibusidlist, the rollback path only removes wakeuplist and detaches the ACPI handle data. That leaves the bus-ID bookkeeping behind and keeps the allocated instance number consumed. Move the bus-ID cleanup and wakeup-list removal into a single helper. Use it from both the normal device teardown path and the deviceadd() rollback path. The wakeup list node is initialized before registration, so it can be deleted without checking whether the device is wakeup- capable like in the original teardown path. [ rjw: Rename acpidevicedellist() to acpidevicecleanup() ] [ rjw: Subject and changelog edits ]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which Ubuntu kernel package families are listed as affected?
The listed packages are ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-fips, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, and ubuntu/linux-gcp-fips.
What is the practical result of encountering the faulty failure path?
A failed device registration can leave an ACPI bus-ID entry behind and keep its allocated instance number consumed. The cleanup change also ensures the device's wakeup-list entry is removed during rollback.