CVE-2026-68181: mei: bus: access mei_device under device_lock on cleanup

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mei: bus: access mei_device under device_lock on cleanup

Fix couple of problems in mei_cl_bus_dev_release():

mei_cl_flush_queues() is running without lock.
bus->file_list access after mei_dev_bus_put(bus) can become a
use-after-free if this was the last reference to bus.

Protect queues cleanup and WARN traversal by device lock there
to avoid the concurrent access problems.
Move WARN traversal before mei_dev_bus_put(bus).

This file uses bus variable name for mei_device, adjust
code of mei_cl_bus_dev_release() to use bus variable too.

The Linux kernel CVE team has assigned CVE-2026-68181 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.6.103 with commit 24f4ceeaeee7983c07590149556a0e33efe2ec90 and fixed in 6.6.148 with commit 441559d4c595f839b39f0ab6a4ae628427c2fd9e
	Issue introduced in 6.12.43 with commit 612c8d21ce6e37b73f3106aec7ffa35959d40261 and fixed in 6.12.101 with commit c88c030a324c9018b77894a19b2564eb66862020
	Issue introduced in 6.17 with commit 35e8a426b16adbecae7a4e0e3c00fc8d0273db53 and fixed in 6.18.42 with commit 59dd34854202d9a3faaa87a85205e553fe7150e1
	Issue introduced in 6.17 with commit 35e8a426b16adbecae7a4e0e3c00fc8d0273db53 and fixed in 7.1.6 with commit 7cf79e8d682fe93777268f029668ce5e214237fd
	Issue introduced in 6.17 with commit 35e8a426b16adbecae7a4e0e3c00fc8d0273db53 and fixed in 7.2-rc5 with commit f112ea910e554d58b4b39a4492b7d302f0f4204f
	Issue introduced in 6.1.149 with commit 6f2a6ef86b23a30b92ad57981de537bce67bfa45
	Issue introduced in 6.15.11 with commit 2f29dce5a5ae06a7db32e4491d72269329a86eeb
	Issue introduced in 6.16.2 with commit 28de6ca5276a94b0589ae1bf026b89fa0eaf14c0

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68181
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/misc/mei/bus.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/441559d4c595f839b39f0ab6a4ae628427c2fd9e
	https://git.kernel.org/stable/c/c88c030a324c9018b77894a19b2564eb66862020
	https://git.kernel.org/stable/c/59dd34854202d9a3faaa87a85205e553fe7150e1
	https://git.kernel.org/stable/c/7cf79e8d682fe93777268f029668ce5e214237fd
	https://git.kernel.org/stable/c/f112ea910e554d58b4b39a4492b7d302f0f4204f