CVE-2026-90402

CVE-2026-90402

High · published September 17, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
1.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: host: Fix controller cleanup on EDL sysfs failure

mhi_register_controller() adds the controller device before creating the

optional trigger_edl sysfs file. If sysfs_create_file() fails, the error

path only drops the device reference and leaves the device registered.

Hence, call device_del() in the error path before put_device().

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00121 · 1.8th percentile
Published
2026-09-17T21:17Z
References (4)
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 16:09Z
    bus: mhi: host: Fix controller cleanup on EDL sysfs failure
    cvelistv5