CVE-2026-90284: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: firmware_loader: do not queue completed sysfs fallback requests fw_load_sysfs_fallback() calls device_add() before adding the fw_priv to pending_fw_head. device_add() publishes the fallback loading interface, so a userspace helper which discovers the device by scanning sysfs can write 0 to the loading attribute and complete the request before it is queued as pending. In that interleaving firmware_loading_store() calls fw_state_done() while pending_list still points to itself, so it cannot remove an entry from pending_fw_head. The subsequent unconditional list_add() then queues an already-completed fw_priv. Once the request is released, pending_fw_head can retain a pointer to freed memory and the next fallback request can fault while validating the list. Only in-flight fallback requests need suspend or reboot abort handling. If the request is already DONE after device_add(), return success from the fallback path without sending another uevent, waiting again, or queueing it as pending. This preserves the invariant that pending_fw_head contains only active fallback requests.

Affected products

• Linux Linux: from 5.10.58, before 5.10.270 (fixed in 5.10.270); from 4.19.203, before 4.20 (fixed in 4.20); from 5.4.140, before 5.5 (fixed in 5.5); from 5.13.10, before 5.14 (fixed in 5.14); from 5.14, before 5.15.221 (fixed in 5.15.221); from 5.16, before 6.1.188 (fixed in 6.1.188); …

Published 2026-09-17. Last modified 2026-09-17.