CVE-2026-68181: mei: bus: access mei_device under device_lock on cleanup

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-10 · updated 2026-08-23

Description

In the Linux kernel, the following vulnerability has been resolved: mei: bus: access mei_device under device_lock on cleanup Fix couple of problems in mei_cl_bus_dev_release(): mei_cl_flush_queues() is running without lock. bus->file_list access after mei_dev_bus_put(bus) can become a use-after-free if this was the last reference to bus. Protect queues cleanup and WARN traversal by device lock there to avoid the concurrent access problems. Move WARN traversal before mei_dev_bus_put(bus). This file uses bus variable name for mei_device, adjust code of mei_cl_bus_dev_release() to use bus variable too.

Affected products

Linux kernel: from 6.1.149 before 6.1.184; from 6.6.103 before 6.6.148; from 6.12.43 before 6.12.101; from 6.15.11 before 6.16; from 6.16.2 before 6.17; 6.17 — fixed in 6.1.184, 6.12.101, 6.16, 6.17, 6.6.148, 7.2

How to fix

Upgrade to a fixed version: Linux kernel 6.1.184, 6.12.101, 6.16, 6.17. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-68181 or the next vulnerability affects your stack