{"id":"CVE-2026-90129","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_balloon: quiesce balloon work before device shutdown\n\nCommit 8bd2fa086a04 (\"virtio: break and reset virtio devices on\ndevice_shutdown()\") added a generic virtio …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_balloon: quiesce balloon work before device shutdown\n\nCommit 8bd2fa086a04 (\"virtio: break and reset virtio devices on\ndevice_shutdown()\") added a generic virtio …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 8bd2fa086a04886798b505f28db4002525895203 < 6dd28e32f4d81a0d57c732b9900de24184e60a7d","Linux >= 8bd2fa086a04886798b505f28db4002525895203 < bdef50a8226fc04899ef6815dd08a002247d47d5","Linux >= 8bd2fa086a04886798b505f28db4002525895203 < 7e17eef04600c399c7e0f5ce765da5cf9d40d8e1","Linux aee42f3d57bfa37b2716df4584edeecf63b9df4c","Linux >= 6.14.9 < 6.15","Linux 6.15"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:17:05.370","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90129","references":[{"url":"https://git.kernel.org/stable/c/6dd28e32f4d81a0d57c732b9900de24184e60a7d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e17eef04600c399c7e0f5ce765da5cf9d40d8e1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bdef50a8226fc04899ef6815dd08a002247d47d5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-17T16:21:47.881Z","epss":0.00198,"epssPercentile":0.09818,"slug":"CVE-2026-90129","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_balloon: quiesce balloon work before device shutdown\n\nCommit 8bd2fa086a04 (\"virtio: break and reset virtio devices on\ndevice_shutdown()\") added a generic virtio bus .shutdown handler that\nbreaks and resets every virtio device during device_shutdown(), i.e. on\nreboot and kexec.\n\nvirtio_balloon provides no .shutdown of its own, so that generic path\nruns while the balloon's asynchronous work is still armed. Once the\ndevice has been broken, virtqueue_add_inbuf() in\nvirtballoon_free_page_report() returns -EIO and trips its\nWARN_ON_ONCE(). On a kernel booted with panic_on_warn that turns an\nordinary reboot, for example a kexec based upgrade, into a fatal panic\nin the middle of device_shutdown(), so the machine never reaches the\nnew kernel.\n\nRelaxing that single WARN_ON_ONCE() would only hide the symptom: the\ninflate/deflate and OOM paths do not warn, they call\nwait_event(vb->acked, ...) and would instead block forever on a broken\nqueue that can no longer complete. The device has to be quiesced, not\njust kept quiet.\n\nAdd a .shutdown handler that quiesces the balloon via the shared\nvirtballoon_quiesce() helper while the device is still alive, and only\nthen breaks and resets it via virtio_device_shutdown(). Unlike\nvirtballoon_remove() the balloon workqueue is not destroyed, as shutdown\ndoes not free the device and cancel_work_sync() together with stop_update\nalready prevent any further work from being queued.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}