CVE-2026-68181

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mei: bus: access mei_device under device_lock on cleanup

Fix couple of problems in mei_cl_bus_dev_release():

mei_cl_flush_queues() is running without lock.

bus->file_list access after mei_dev_bus_put(bus) can become a

use-after-free if this was the last reference to bus.

Protect queues cleanup and WARN traversal by device lock there

to avoid the concurrent access problems.

Move WARN traversal before mei_dev_bus_put(bus).

This file uses bus variable name for mei_device, adjust

code of mei_cl_bus_dev_release() to use bus variable too.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References