CVE-2026-90194
In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: fix bus ID cleanup on device_add() failures When device_add() fails after acpi_device_set_name() has allocated an instance ID and a new acpi_device_bus_id has been linked into acpi_bus_id_list, the rollback path only removes wakeup_list and detaches the ACPI handle data. That leaves the bus-ID bookkeeping behind and keeps the allocated instance number consumed. Move the bus-ID cleanup and wakeup-list removal into a single helper. Use it from both the normal device teardown path and the device_add() rollback path. The wakeup list node is initialized before registration, so it can be deleted without checking whether the device is wakeup- capable like in the original teardown path. [ rjw: Rename acpi_device_del_list() to acpi_device_cleanup() ] [ rjw: Subject and changelog edits ]
Affected versions
Linux kernel versions
3.14
and later are affected. Fixed in
6.1.188,
6.6.157,
6.12.110,
6.18.52,
7.2.6,
7.3-rc1
and their respective stable series.
References
6 totalFrequently asked questions
-
What is CVE-2026-90194?
CVE-2026-90194 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 3.14 onward and has been patched in 6.1.188, 6.6.157, 6.12.110 and others. CVE-2026-90194 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-90194?
Yes. CVE-2026-90194 has been patched. Fixed versions include 6.1.188, 6.6.157, 6.12.110 and others. If you are running Linux kernel 3.14 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-90194 actively exploited?
No. CVE-2026-90194 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.