The Linux kernel's mhi_register_controller() function adds a controller device before creating an optional trigger_edl sysfs file. If sysfs_create_file() fails, the error handling path previously only dropped the device reference without unregistering the device, leaving it registered improperly. The fix involves calling device_del() in the error path before put_device() to ensure proper cleanup of the controller device on failure.

Improper cleanup of the controller device on sysfs creation failure could lead to resource leaks or inconsistent device state, potentially causing system instability or denial of service. The CVSS score of 7.0 indicates high severity with high impact on confidentiality, integrity, and availability, but exploitation requires local access with high attack complexity and low privileges.

A fix is available and has been applied to the Linux kernel to properly clean up the controller device on sysfs creation failure. Users and administrators should update to the fixed kernel version once released. No additional mitigation is required beyond applying the official patch.