CVE-2026-90194

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ACPI: scan: fix bus ID cleanup on device_add() failures

When device_add() fails after acpi_device_set_name() has allocated an

instance ID and a new acpi_device_bus_id has been linked into

acpi_bus_id_list, the rollback path only removes wakeup_list and

detaches the ACPI handle data.

That leaves the bus-ID bookkeeping behind and keeps the allocated

instance number consumed.

Move the bus-ID cleanup and wakeup-list removal into a single helper.

Use it from both the normal device teardown path and the device_add()

rollback path. The wakeup list node is initialized before registration,

so it can be deleted without checking whether the device is wakeup-

capable like in the original teardown path.

[ rjw: Rename acpi_device_del_list() to acpi_device_cleanup() ]

[ rjw: Subject and changelog edits ]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References