CVE-2026-90402 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux kernel-based systems should assess exposure and verify patch deployment to prevent potential device registration issues. They should also monitor Linux kernel logs for signs of attempted exploitation or device registration anomalies.

Why it matters

CVE-2026-90402 is a vulnerability in the Linux kernel's MHI host controller that can cause device registration issues if the optional `trigger_edl` sysfs file creation fails. Linux kernel maintainers and users should assess exposure and verify patch deployment to prevent potential issues.

• Verify patch deployment for Linux kernel versions to prevent potential device registration issues
• Monitor Linux kernel logs for signs of attempted exploitation or device registration anomalies

Technical summary

The Linux kernel's MHI host controller has a vulnerability that occurs when the `mhi_register_controller` function adds a controller device before creating the optional `trigger_edl` sysfs file. If `sysfs_create_file` fails, the error path only drops the device reference, leaving the device registered. This issue can cause device registration problems if the optional `trigger_edl` sysfs file creation fails. Linux kernel maintainers and users should assess exposure and verify patch deployment to prevent potential issues.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify patch deployment.

Recommended defensive actions

• Assess exposure of Linux kernel deployments to CVE-2026-90402
• Verify patch deployment for Linux kernel versions
• Monitor Linux kernel logs for signs of attempted exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Four source references from the Linux kernel Git repository are available. Linux kernel maintainers and users should verify patch deployment and assess exposure to prevent potential issues. The vulnerability occurs in the MHI host controller, and its exploitation could lead to device registration issues.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.