{"id":"CVE-2026-90284","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware_loader: do not queue completed sysfs fallback requests\n\nfw_load_sysfs_fallback() calls device_add() before adding the fw_priv to\npending_fw_head","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware_loader: do not queue completed sysfs fallback requests\n\nfw_load_sysfs_fallback() calls device_add() before adding the fw_priv to\npending_fw_head. device_add() …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= ecb739cf15a9bae040ce6b60209b78b92512d120 < c8b97c5130f27b64fa2cfe1aa4bebb13f724c6c7","Linux >= 75d95e2e39b27f733f21e6668af1c9893a97de5e < 93a2385730540105df8524447dcc11309ad280f9","Linux >= 75d95e2e39b27f733f21e6668af1c9893a97de5e < ea33fac0df7fe7b49a4b27acb83e227b82317d1d","Linux >= 75d95e2e39b27f733f21e6668af1c9893a97de5e < 5a250bff75a446374c05622973b18b4ab662b504","Linux >= 75d95e2e39b27f733f21e6668af1c9893a97de5e < 85aeb8fc61839098ae0942ccba86e669c08e75d4","Linux >= 75d95e2e39b27f733f21e6668af1c9893a97de5e < 6eaa632d0ed7bbb84f9cb670e5ec4e2cecf4cc7b","Linux >= 75d95e2e39b27f733f21e6668af1c9893a97de5e < fb4824880b0dba0e7b3a497c46c642f979630392","Linux >= 75d95e2e39b27f733f21e6668af1c9893a97de5e < b48373c901951fad1a26bd7c33ad91172b3945b5","Linux 67cf0fbcac0d42d4d4686cddc1e39f465bbfec37","Linux d09639528b66b5c7c20dc8f7fb8928aacabd40bb","Linux c14a54675db7131791402fa22fb0fa6da1f5fb66","Linux >= 5.10.58 < 5.10.270","Linux >= 4.19.203 < 4.20","Linux >= 5.4.140 < 5.5","Linux >= 5.13.10 < 5.14","Linux 5.14"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:17:25.203","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90284","references":[{"url":"https://git.kernel.org/stable/c/5a250bff75a446374c05622973b18b4ab662b504","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6eaa632d0ed7bbb84f9cb670e5ec4e2cecf4cc7b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/85aeb8fc61839098ae0942ccba86e669c08e75d4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/93a2385730540105df8524447dcc11309ad280f9","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b48373c901951fad1a26bd7c33ad91172b3945b5","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c8b97c5130f27b64fa2cfe1aa4bebb13f724c6c7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea33fac0df7fe7b49a4b27acb83e227b82317d1d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fb4824880b0dba0e7b3a497c46c642f979630392","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-17T16:21:47.834Z","epss":0.0021,"epssPercentile":0.11553,"slug":"CVE-2026-90284","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfirmware_loader: do not queue completed sysfs fallback requests\n\nfw_load_sysfs_fallback() calls device_add() before adding the fw_priv to\npending_fw_head. device_add() publishes the fallback loading interface, so\na userspace helper which discovers the device by scanning sysfs can write 0\nto the loading attribute and complete the request before it is queued as\npending.\n\nIn that interleaving firmware_loading_store() calls fw_state_done() while\npending_list still points to itself, so it cannot remove an entry from\npending_fw_head. The subsequent unconditional list_add() then queues an\nalready-completed fw_priv. Once the request is released, pending_fw_head\ncan retain a pointer to freed memory and the next fallback request can\nfault while validating the list.\n\nOnly in-flight fallback requests need suspend or reboot abort handling. If\nthe request is already DONE after device_add(), return success from the\nfallback path without sending another uevent, waiting again, or queueing it\nas pending. This preserves the invariant that pending_fw_head contains only\nactive fallback requests.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}