CVE-2026-68181

mei: bus: access mei_device under device_lock on cleanup

State: Published
Severity: Not scored
Published: Aug 10, 2026
Updated: Aug 23, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

mei: bus: access mei_device under device_lock on cleanup

Fix couple of problems in mei_cl_bus_dev_release():

mei_cl_flush_queues() is running without lock. bus->file_list access after mei_dev_bus_put(bus) can become a use-after-free if this was the last reference to bus.

Protect queues cleanup and WARN traversal by device lock there to avoid the concurrent access problems. Move WARN traversal before mei_dev_bus_put(bus).

This file uses bus variable name for mei_device, adjust code of mei_cl_bus_dev_release() to use bus variable too.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	6f2a6ef86b23a30b92ad57981de537bce67bfa45 to before 02e3a755086db847d795f2593ebc45e8ee4f1755Affected 24f4ceeaeee7983c07590149556a0e33efe2ec90 to before 441559d4c595f839b39f0ab6a4ae628427c2fd9eAffected 612c8d21ce6e37b73f3106aec7ffa35959d40261 to before c88c030a324c9018b77894a19b2564eb66862020Affected 35e8a426b16adbecae7a4e0e3c00fc8d0273db53 to before 59dd34854202d9a3faaa87a85205e553fe7150e1Affected 35e8a426b16adbecae7a4e0e3c00fc8d0273db53 to before 7cf79e8d682fe93777268f029668ce5e214237fdAffected 35e8a426b16adbecae7a4e0e3c00fc8d0273db53 to before f112ea910e554d58b4b39a4492b7d302f0f4204fAffected 2f29dce5a5ae06a7db32e4491d72269329a86eebAffected 28de6ca5276a94b0589ae1bf026b89fa0eaf14c0Affected 6.1.149 to before 6.1.184Affected 6.6.103 to before 6.6.148Affected 6.12.43 to before 6.12.101Affected 6.15.11 to before 6.16Affected 6.16.2 to before 6.17Affected
LinuxLinux	6.17Affected before 6.17Not affected 6.1.184 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

6f2a6ef86b23a30b92ad57981de537bce67bfa45 to before 02e3a755086db847d795f2593ebc45e8ee4f1755Affected
24f4ceeaeee7983c07590149556a0e33efe2ec90 to before 441559d4c595f839b39f0ab6a4ae628427c2fd9eAffected
612c8d21ce6e37b73f3106aec7ffa35959d40261 to before c88c030a324c9018b77894a19b2564eb66862020Affected
35e8a426b16adbecae7a4e0e3c00fc8d0273db53 to before 59dd34854202d9a3faaa87a85205e553fe7150e1Affected
35e8a426b16adbecae7a4e0e3c00fc8d0273db53 to before 7cf79e8d682fe93777268f029668ce5e214237fdAffected
35e8a426b16adbecae7a4e0e3c00fc8d0273db53 to before f112ea910e554d58b4b39a4492b7d302f0f4204fAffected
2f29dce5a5ae06a7db32e4491d72269329a86eebAffected
28de6ca5276a94b0589ae1bf026b89fa0eaf14c0Affected
6.1.149 to before 6.1.184Affected
6.6.103 to before 6.6.148Affected
6.12.43 to before 6.12.101Affected
6.15.11 to before 6.16Affected
6.16.2 to before 6.17Affected

LinuxLinux

6.17Affected
before 6.17Not affected
6.1.184 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.