---
id: CVE-2026-90194
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ACPI: scan: fix bus ID cleanup on device_add() failures

  When device_add() fails after acpi_device_set_name() has allocated an
  instance ID and a new acpi_device_bus_id …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ACPI: scan: fix bus ID cleanup on device_add() failures

  When device_add() fails after acpi_device_set_name() has allocated an
  instance ID and a new acpi_device_bus_id …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d783156ea38431b20af0d4f910a6f9f9054d33b9 <
    8cc2017aa804f157e717b5fd471e50fbddfec654
  - >-
    Linux >= d783156ea38431b20af0d4f910a6f9f9054d33b9 <
    f30379b8a4e24623594235dd5aefb2957e0cc228
  - >-
    Linux >= d783156ea38431b20af0d4f910a6f9f9054d33b9 <
    83ee65feadc88de681abc6e977d54eceda95abd7
  - >-
    Linux >= d783156ea38431b20af0d4f910a6f9f9054d33b9 <
    15512c6b5dea72fb5f1f41c1aa96f3f32531ca03
  - >-
    Linux >= d783156ea38431b20af0d4f910a6f9f9054d33b9 <
    0b9053cd0955c7cd66d71a8442be33926d70e197
  - >-
    Linux >= d783156ea38431b20af0d4f910a6f9f9054d33b9 <
    a414485ebc2aa50907d0ce97cde2b1a353696897
  - Linux 3.14
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:14.150'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90194'
references:
  - url: 'https://git.kernel.org/stable/c/0b9053cd0955c7cd66d71a8442be33926d70e197'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/15512c6b5dea72fb5f1f41c1aa96f3f32531ca03'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/83ee65feadc88de681abc6e977d54eceda95abd7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8cc2017aa804f157e717b5fd471e50fbddfec654'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a414485ebc2aa50907d0ce97cde2b1a353696897'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f30379b8a4e24623594235dd5aefb2957e0cc228'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.862Z'
epss: 0.00215
epssPercentile: 0.10516
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ACPI: scan: fix bus ID cleanup on device_add() failures

When device_add() fails after acpi_device_set_name() has allocated an
instance ID and a new acpi_device_bus_id has been linked into
acpi_bus_id_list, the rollback path only removes wakeup_list and
detaches the ACPI handle data.

That leaves the bus-ID bookkeeping behind and keeps the allocated
instance number consumed.

Move the bus-ID cleanup and wakeup-list removal into a single helper.

Use it from both the normal device teardown path and the device_add()
rollback path. The wakeup list node is initialized before registration,
so it can be deleted without checking whether the device is wakeup-
capable like in the original teardown path.

[ rjw: Rename acpi_device_del_list() to acpi_device_cleanup() ]
[ rjw: Subject and changelog edits ]

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.