Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-90194— ACPI: scan: fix bus ID cleanup on device_add() failures

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： ACPI：扫描：修复 device_add() 失败时的总线 ID 清理问题 当 在 分配实例 ID 并将新的 链接到 后失败时，当前的回滚路径仅移除了 wakeup_list 并解关联 ACPI 句柄数据。 这导致总线 ID 的管理记录被遗留下来，同时已分配的实例编号一直处于“已占用”状态。 解决方案是将总线 ID 清理和唤醒列表移除操作合并到一个统一的辅助函数中。 该辅助函数同时用于常规的设备拆卸路径和 的回滚路径。由于唤醒列表节点在注册前就已初始化，因此可以在不进行“

AI Predicted 3.1 Difficulty: Theoretical EPSS 0.21% · P11

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux d783156ea38431b20af0d4f910a6f9f9054d33b9< 8cc2017aa804f157e717b5fd471e50fbddfec654 affected
d783156ea38431b20af0d4f910a6f9f9054d33b9< f30379b8a4e24623594235dd5aefb2957e0cc228 affected
d783156ea38431b20af0d4f910a6f9f9054d33b9< 83ee65feadc88de681abc6e977d54eceda95abd7 affected
d783156ea38431b20af0d4f910a6f9f9054d33b9< 15512c6b5dea72fb5f1f41c1aa96f3f32531ca03 affected
d783156ea38431b20af0d4f910a6f9f9054d33b9< 0b9053cd0955c7cd66d71a8442be33926d70e197 affected
d783156ea38431b20af0d4f910a6f9f9054d33b9< a414485ebc2aa50907d0ce97cde2b1a353696897 affected
3.14 affected
< 3.14 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90194

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ACPI: scan: fix bus ID cleanup on device_add() failures
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: fix bus ID cleanup on device_add() failures When device_add() fails after acpi_device_set_name() has allocated an instance ID and a new acpi_device_bus_id has been linked into acpi_bus_id_list, the rollback path only removes wakeup_list and detaches the ACPI handle data. That leaves the bus-ID bookkeeping behind and keeps the allocated instance number consumed. Move the bus-ID cleanup and wakeup-list removal into a single helper. Use it from both the normal device teardown path and the device_add() rollback path. The wakeup list node is initialized before registration, so it can be deleted without checking whether the device is wakeup- capable like in the original teardown path. [ rjw: Rename acpi_device_del_list() to acpi_device_cleanup() ] [ rjw: Subject and changelog edits ]
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux d783156ea38431b20af0d4f910a6f9f9054d33b9 ~ 8cc2017aa804f157e717b5fd471e50fbddfec654 -
Linux Linux 3.14 -

II. Public POCs for CVE-2026-90194

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90194

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-90194 (4)

Same Patch Batch · Linux · 2026-09-17 · 600 CVEs total

CVE-2026-90235 9.8 CRITICAL sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
CVE-2026-90104 9.8 CRITICAL NFSv4.1: zero referring call lists before decoding
CVE-2026-90173 9.8 CRITICAL smb: smbdirect: free completion queues with ib_free_cq()
CVE-2026-92489 9.8 CRITICAL xfrm: Fix skb double-free in xfrm_dev_direct_output()
CVE-2026-90151 9.8 CRITICAL NFSv4: remove callback IDR entry on client allocation failure
CVE-2026-90110 9.4 CRITICAL inetpeer: randomize RB-tree node comparison using SipHash
CVE-2026-90230 9.1 CRITICAL nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
CVE-2026-90414 9.1 CRITICAL IB/isert: reject PDUs declaring more data than was received
CVE-2026-90413 9.1 CRITICAL IB/isert: reject login PDUs declaring more data than was received
CVE-2026-90380 8.8 HIGH wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
CVE-2026-93042 8.8 HIGH dmaengine: dw-edma: Terminate all descriptors without callbacks
CVE-2026-90425 8.8 HIGH iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
CVE-2026-90240 8.8 HIGH iommu/vt-d: Flush context cache with correct SID when tearing down aliases
CVE-2026-90381 8.8 HIGH wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
CVE-2026-90329 8.8 HIGH HID: synchronize input before cleaning up a failed probe
CVE-2026-90357 8.8 HIGH wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
CVE-2026-90379 8.8 HIGH wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash
CVE-2026-90162 8.8 HIGH ksmbd: defer publishing granted locks to prevent UAF/double-free race
CVE-2026-93189 8.8 HIGH HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
CVE-2026-90255 8.8 HIGH Bluetooth: hci_conn: fix the SCO setup context lifetime

Showing top 20 of 600 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90194

No comments yet

Leave a comment