CVE-2026-90216

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ubi: Fix rollback for explicit UBI device numbers

ubi_init_attach() rolls back module initialization failures by scanning

ubi_devices[0..i-1], where i is the mtd= parameter index. That assumes

the parameter index matches the UBI device number.

That assumption is not true when mtd= specifies an explicit ubi_num. A

successfully attached device can be stored at a higher ubi_devices[]

slot, and a later failure can miss it during rollback.

Scan the full ubi_devices[] array and detach by the actual array index,

matching the way UBI devices are stored.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References