CVE-2026-93136

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation

mhi_ep_create_device() takes one device reference for the UL channel and

another for the DL channel after allocating the transfer device. These

references are normally released by mhi_ep_destroy_device() before the

device itself is removed.

If dev_set_name() or device_add() fails, the error path currently drops

only one reference. The remaining channel references keep the device

from being released and leave the channels associated with a device that

was never registered.

Route both failures through a common unwind path that drops the DL

channel reference, the UL channel reference, and the initial reference

from device_initialize().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References