high · CVSS v3 7.1
CVE-2026-93136
A reference‑count leak in the Linux kernel’s MHI device creation path can cause devices to remain allocated even after failure, potentially
Overview
A reference‑count leak in the Linux kernel’s MHI device creation path can cause devices to remain allocated even after failure, potentially exhausting kernel resources and leading to a denial‑of‑service condition. The issue occurs when device initialization fails, leaving channel references unreleased.
Description
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation mhi_ep_create_device() takes one device reference for the UL channel and another for the DL channel after allocating the transfer device. These references are normally released by mhi_ep_destroy_device() before the device itself is removed. If dev_set_name() or device_add() fails, the error path currently drops only one reference. The remaining channel references keep the device from being released and leave the channels associated with a device that was never registered. Route both failures through a common unwind path that drops the DL channel reference, the UL channel reference, and the initial reference from device_initialize().
Impact
The leak can keep kernel memory and device structures allocated, leading to resource exhaustion and possible denial of service. Confidentiality, integrity, and availability are not directly compromised, but the system’s stability and uptime are affected.
Remediation
['Apply the latest kernel patch that fixes the MHI refcount leak.', 'Upgrade to a kernel version that includes the fix (e.g., 6.10 or newer).', 'Verify that device drivers for MHI devices are updated and that error handling follows the common unwind path.', 'Monitor system logs (dmesg, journalctl) for MHI related errors and ensure no lingering device entries remain.', 'If upgrading is not immediately possible, consider temporarily disabling or limiting MHI device usage to prevent resource exhaustion.']
Risk context
High severity (CVSS 7.1) with no remote code execution. The vulnerability can lead to denial of service through resource exhaustion, making it a moderate‑to‑high urgency issue for systems that rely on MHI devices.
Affected products
- Linux kernel
- MHI devices
- Qualcomm Snapdragon
- Android
- Embedded systems
Scores
- Severity
- high
- CVSS v2
- 5.6
- CVSS v3
- 7.1
- CVSS v4
- —
- EPSS
- —