---
id: CVE-2026-90215
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mtd: ubi: Release device reference on busy detach

  ubi_detach_mtd_dev() obtains a device reference through ubi_get_device()
  before checking whether the UBI device is bu…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  mtd: ubi: Release device reference on busy detach

  ubi_detach_mtd_dev() obtains a device reference through ubi_get_device()
  before checking whether the UBI device is bu…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 7e84c961b2eb062d2f47037dcca52dcd1d3615b5 <
    87812858c4c8df979cb70bcd0040b925a543df6f
  - >-
    Linux >= 7e84c961b2eb062d2f47037dcca52dcd1d3615b5 <
    e065960366b55ab21e6c643c30dec2a41451900b
  - >-
    Linux >= 7e84c961b2eb062d2f47037dcca52dcd1d3615b5 <
    851c5e9a829d56cb0982965f07ef8966a6722884
  - >-
    Linux >= 7e84c961b2eb062d2f47037dcca52dcd1d3615b5 <
    31dd710cd84d5dd63c49f640d3a9f36c9699ca95
  - Linux 6.9
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:16.790'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90215'
references:
  - url: 'https://git.kernel.org/stable/c/31dd710cd84d5dd63c49f640d3a9f36c9699ca95'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/851c5e9a829d56cb0982965f07ef8966a6722884'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/87812858c4c8df979cb70bcd0040b925a543df6f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e065960366b55ab21e6c643c30dec2a41451900b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.856Z'
epss: 0.00168
epssPercentile: 0.06487
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

mtd: ubi: Release device reference on busy detach

ubi_detach_mtd_dev() obtains a device reference through ubi_get_device()
before checking whether the UBI device is busy. The busy return path drops
ubi->ref_count but leaves the device reference held, so the device object
cannot be released after a later detach.

Drop the device reference before returning -EBUSY.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.