CVE-2026-90216
Last modified
CVE-2026-90216 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: ubi: Fix rollback for explicit UBI device numbers ubi_init_attach() rolls back module initialization failures by scanning ubi_devices[0..i-1], where i is the mtd= parameter index. That assumes the parameter index matches the UBI device number. That assumption is not true when mtd= specifies an explicit ubi_num.
Description
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix rollback for explicit UBI device numbers ubi_init_attach() rolls back module initialization failures by scanning ubi_devices[0..i-1], where i is the mtd= parameter index. That assumes the parameter index matches the UBI device number. That assumption is not true when mtd= specifies an explicit ubi_num. A successfully attached device can be stored at a higher ubi_devices[] slot, and a later failure can miss it during rollback. Scan the full ubi_devices[] array and detach by the actual array index, matching the way UBI devices are stored.
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 83ff59a066637a6c28844bbf43009459408240f4, < 83c978921688af40dcab6db74882d1ff9b0b765c; >= 83ff59a066637a6c28844bbf43009459408240f4, < 6b92e66ec6dd8019e8efb2a568ef7c967c5a18c5; >= 83ff59a066637a6c28844bbf43009459408240f4, < 4417ab6ecad01cf2d01045ef8104c95a66b0e893; >= 83ff59a066637a6c28844bbf43009459408240f4, < 552e565ed8846e7db143e4a6bdf3f5677453c686; >= 83ff59a066637a6c28844bbf43009459408240f4, < 9754f049d5f1945d4c691d1f52824eb8daf8f9be; >= 83ff59a066637a6c28844bbf43009459408240f4, < e3f7e58189bc222971ddc860f1716f37e51ba996; >= 83ff59a066637a6c28844bbf43009459408240f4, < 87b3da4acb860605643ebee312178f13b20744cf; >= 83ff59a066637a6c28844bbf43009459408240f4, < 5b0a6b554e12a97f9771a9a9f4ea1f5457373c73 |
| Linux | Linux | 3.11 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-90216?
How severe is CVE-2026-90216?
How do I fix CVE-2026-90216?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-90210In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-90211In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90212In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90213In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90214In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90215In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90217In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2026-90218In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90219In the Linux kernel, the following vulnerability has been re…
- CVE-2026-9022The Splide Carousel Block plugin for WordPress is vulnerable…6.4
- CVE-2026-90220In the Linux kernel, the following vulnerability has been re…
- CVE-2026-90221In the Linux kernel, the following vulnerability has been re…
Are you affected by CVE-2026-90216?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST