CVE-2026-90360: Linux

EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: regulator: core: use system_freezable_wq for init complete work schedule_delayed_work() uses system_wq, which is non-freezable, allowing regulator_init_complete_work to run concurrently with system suspend. This work fires ~30s after boot to disable unused regulators via I2C. When it races with PM suspend, the I2C adapter may already be suspended, triggering a -ESHUTDOWN warning in __i2c_transfer(): WARNING: ... at __i2c_transfer+0x36c/0x3c8 Call trace: __i2c_transfer i2c_transfer regmap_i2c_write _regmap_update_bits regulator_disable_regmap _regulator_do_disable regulator_late_cleanup regulator_init_complete_work_function process_one_work Switch to system_freezable_wq so the work is frozen before any device is suspended, eliminating the race.

Affected products

• Linux Linux: from 4.9.195, before 4.9.207 (fixed in 4.9.207); from 4.14.147, before 4.14.160 (fixed in 4.14.160); from 4.19.77, before 4.20 (fixed in 4.20); from 5.2.19, before 5.3 (fixed in 5.3); from 5.3.4, before 5.4 (fixed in 5.4); from 5.4, before 5.10.270 (fixed in 5.10.270); …

Published 2026-09-17. Last modified 2026-09-17.