---
id: CVE-2026-93136
title: >-
  In the Linux kernel, the following vulnerability has been resolved:


  bus: mhi: ep: Fix device refcount leak in the error path of MHI device
  creation


  mhi_ep_create_device() takes one device reference for the UL channel and

  another for th…
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  bus: mhi: ep: Fix device refcount leak in the error path of MHI device
  creation


  mhi_ep_create_device() takes one device reference for the UL channel and

  another for th…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 297c77a0f27312b9a04696018c4cbd47926ca92b <
    8acc3813ab5015af73eeb74c9032443162f122d1
  - >-
    Linux >= 297c77a0f27312b9a04696018c4cbd47926ca92b <
    51ddb831a36102fd0ea25f354935e49abce9f0a1
  - >-
    Linux >= 297c77a0f27312b9a04696018c4cbd47926ca92b <
    4fae8fd4adc7f4765463ddeb1a5fad23936432f6
  - >-
    Linux >= 297c77a0f27312b9a04696018c4cbd47926ca92b <
    5587e7871ce994bb079f97fe7e430d99627e5292
  - >-
    Linux >= 297c77a0f27312b9a04696018c4cbd47926ca92b <
    8f3f64faee335eb678fd7dca7b95dfe3d0b271fd
  - >-
    Linux >= 297c77a0f27312b9a04696018c4cbd47926ca92b <
    6f12862600bb70e599a614d706a095ea5f8f9858
  - Linux 5.19
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:18:08.480'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93136'
references:
  - url: 'https://git.kernel.org/stable/c/4fae8fd4adc7f4765463ddeb1a5fad23936432f6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/51ddb831a36102fd0ea25f354935e49abce9f0a1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5587e7871ce994bb079f97fe7e430d99627e5292'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6f12862600bb70e599a614d706a095ea5f8f9858'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8acc3813ab5015af73eeb74c9032443162f122d1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8f3f64faee335eb678fd7dca7b95dfe3d0b271fd'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.745Z'
epss: 0.00215
epssPercentile: 0.12121
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation

mhi_ep_create_device() takes one device reference for the UL channel and
another for the DL channel after allocating the transfer device. These
references are normally released by mhi_ep_destroy_device() before the
device itself is removed.

If dev_set_name() or device_add() fails, the error path currently drops
only one reference. The remaining channel references keep the device
from being released and leave the channels associated with a device that
was never registered.

Route both failures through a common unwind path that drops the DL
channel reference, the UL channel reference, and the initial reference
from device_initialize().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.