CVE-2026-90284

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

firmware_loader: do not queue completed sysfs fallback requests

fw_load_sysfs_fallback() calls device_add() before adding the fw_priv to

pending_fw_head. device_add() publishes the fallback loading interface, so

a userspace helper which discovers the device by scanning sysfs can write 0

to the loading attribute and complete the request before it is queued as

pending.

In that interleaving firmware_loading_store() calls fw_state_done() while

pending_list still points to itself, so it cannot remove an entry from

pending_fw_head. The subsequent unconditional list_add() then queues an

already-completed fw_priv. Once the request is released, pending_fw_head

can retain a pointer to freed memory and the next fallback request can

fault while validating the list.

Only in-flight fallback requests need suspend or reboot abort handling. If

the request is already DONE after device_add(), return success from the

fallback path wit

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References