A high-severity resource management vulnerability in the Linux kernel MHI host controller driver could allow a local authenticated attacker to trigger improper device cleanup and potentially achieve unauthorized system impact.

The vulnerability exists within the mhi_register_controller function, where a failure in sysfs_create_file leads to an incomplete cleanup of the controller device. An attacker with local low-level privileges can trigger this error path, causing the system to leave the device registered while dropping the device reference, which results in a kernel-level resource handling error.

The potential for kernel-level resource mismanagement poses a significant risk to system stability and integrity. Although the attack requires local access and specific conditions, the CVSS score of 7.0 highlights the danger of potential privilege escalation or denial of service, which could disrupt critical business operations or facilitate unauthorized access to sensitive kernel memory.

Immediate Action: Update the Linux kernel to version 6.12.110, 6.18.52, 7.2.6, or a later stable release where this cleanup path has been corrected.

Proactive Monitoring: Monitor system logs for kernel-related errors or crashes specifically associated with MHI controller initialization or sysfs failures.

Compensating Controls: Restrict local access to the system to authorized users only, as the vulnerability requires local interaction to successfully trigger the error condition.

Public Exploit Available: False

Given the severity of kernel-level vulnerabilities, it is imperative that system administrators prioritize patching affected Linux distributions. Ensure that kernel updates are tested in staging environments before deployment, but move quickly to apply the provided fixes to prevent potential exploitation of the MHI driver cleanup mechanism.