{"cve":"CVE-2026-90215","nvd":{"published":"2026-09-17T17:17:16.790","modified":"2026-10-19T09:19:11.643","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: ubi: Release device reference on busy detach\n\nubi_detach_mtd_dev() obtains a device reference through ubi_get_device()\nbefore checking whether the UBI device is busy. The busy return path drops\nubi->ref_count but leaves the device reference held, so the device object\ncannot be released after a later detach.\n\nDrop the device reference before returning -EBUSY.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/31dd710cd84d5dd63c49f640d3a9f36c9699ca95","https://git.kernel.org/stable/c/851c5e9a829d56cb0982965f07ef8966a6722884","https://git.kernel.org/stable/c/87812858c4c8df979cb70bcd0040b925a543df6f","https://git.kernel.org/stable/c/e065960366b55ab21e6c643c30dec2a41451900b"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-90215","score":0.00168,"percentile":0.06024,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}