In the Linux kernel, the following vulnerability has been resolved: ubi: Fix rollback for explicit UBI device numbers ubi_init_attach() rolls back module initialization failures by scanning ubi_devices[0..i-1], where i is the mtd= parameter index. That assumes the parameter index matches the UBI device number. That assumption is not true when mtd= specifies an explicit ubi_num. A successfully attached device can be stored at a higher ubi_devices[] slot, and a later failure can miss it during rollback. Scan the full ubi_devices[] array and detach by the actual array index, matching the way UBI devices are stored.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/4417ab6ecad01cf2d01045ef8104c95a66b0e893 cve-icon cve-icon
https://git.kernel.org/stable/c/552e565ed8846e7db143e4a6bdf3f5677453c686 cve-icon cve-icon
https://git.kernel.org/stable/c/5b0a6b554e12a97f9771a9a9f4ea1f5457373c73 cve-icon cve-icon
https://git.kernel.org/stable/c/6b92e66ec6dd8019e8efb2a568ef7c967c5a18c5 cve-icon cve-icon
https://git.kernel.org/stable/c/83c978921688af40dcab6db74882d1ff9b0b765c cve-icon cve-icon
https://git.kernel.org/stable/c/87b3da4acb860605643ebee312178f13b20744cf cve-icon cve-icon
https://git.kernel.org/stable/c/9754f049d5f1945d4c691d1f52824eb8daf8f9be cve-icon cve-icon
https://git.kernel.org/stable/c/e3f7e58189bc222971ddc860f1716f37e51ba996 cve-icon cve-icon
History

Sun, 20 Sep 2026 01:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-401

Thu, 17 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ubi: Fix rollback for explicit UBI device numbers ubi_init_attach() rolls back module initialization failures by scanning ubi_devices[0..i-1], where i is the mtd= parameter index. That assumes the parameter index matches the UBI device number. That assumption is not true when mtd= specifies an explicit ubi_num. A successfully attached device can be stored at a higher ubi_devices[] slot, and a later failure can miss it during rollback. Scan the full ubi_devices[] array and detach by the actual array index, matching the way UBI devices are stored.
Title ubi: Fix rollback for explicit UBI device numbers
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-17T16:07:28.730Z

Updated: 2026-10-19T08:59:52.143Z

Reserved: 2026-09-11T19:38:34.793Z

Link: CVE-2026-90216

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-17T17:17:16.900

Modified: 2026-10-19T09:19:11.733

Link: CVE-2026-90216

cve-icon Redhat

No data.