CVE-2026-93136
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation mhi_ep_create_device() takes one device reference for the UL channel and another for the DL channel after allocating the transfer device. These references are normally released by mhi_ep_destroy_device() before the device itself is removed. If dev_set_name() or device_add() fails, the error path currently drops only one reference. The remaining channel references keep the device from being released and leave the channels associated with a device that was never registered. Route both failures through a common unwind path that drops the DL channel reference, the UL channel reference, and the initial reference from device_initialize().
Affected versions
Linux kernel versions
5.19
and later are affected. Fixed in
6.1.188,
6.6.157,
6.12.110,
6.18.52,
7.2.6,
7.3-rc1
and their respective stable series.
References
6 totalFrequently asked questions
-
What is CVE-2026-93136?
CVE-2026-93136 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.19 onward and has been patched in 6.1.188, 6.6.157, 6.12.110 and others. CVE-2026-93136 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-93136?
Yes. CVE-2026-93136 has been patched. Fixed versions include 6.1.188, 6.6.157, 6.12.110 and others. If you are running Linux kernel 5.19 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-93136 actively exploited?
No. CVE-2026-93136 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.