---
id: CVE-2026-90284
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  firmware_loader: do not queue completed sysfs fallback requests

  fw_load_sysfs_fallback() calls device_add() before adding the fw_priv to
  pending_fw_head
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  firmware_loader: do not queue completed sysfs fallback requests

  fw_load_sysfs_fallback() calls device_add() before adding the fw_priv to
  pending_fw_head. device_add() …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ecb739cf15a9bae040ce6b60209b78b92512d120 <
    c8b97c5130f27b64fa2cfe1aa4bebb13f724c6c7
  - >-
    Linux >= 75d95e2e39b27f733f21e6668af1c9893a97de5e <
    93a2385730540105df8524447dcc11309ad280f9
  - >-
    Linux >= 75d95e2e39b27f733f21e6668af1c9893a97de5e <
    ea33fac0df7fe7b49a4b27acb83e227b82317d1d
  - >-
    Linux >= 75d95e2e39b27f733f21e6668af1c9893a97de5e <
    5a250bff75a446374c05622973b18b4ab662b504
  - >-
    Linux >= 75d95e2e39b27f733f21e6668af1c9893a97de5e <
    85aeb8fc61839098ae0942ccba86e669c08e75d4
  - >-
    Linux >= 75d95e2e39b27f733f21e6668af1c9893a97de5e <
    6eaa632d0ed7bbb84f9cb670e5ec4e2cecf4cc7b
  - >-
    Linux >= 75d95e2e39b27f733f21e6668af1c9893a97de5e <
    fb4824880b0dba0e7b3a497c46c642f979630392
  - >-
    Linux >= 75d95e2e39b27f733f21e6668af1c9893a97de5e <
    b48373c901951fad1a26bd7c33ad91172b3945b5
  - Linux 67cf0fbcac0d42d4d4686cddc1e39f465bbfec37
  - Linux d09639528b66b5c7c20dc8f7fb8928aacabd40bb
  - Linux c14a54675db7131791402fa22fb0fa6da1f5fb66
  - Linux >= 5.10.58 < 5.10.270
  - Linux >= 4.19.203 < 4.20
  - Linux >= 5.4.140 < 5.5
  - Linux >= 5.13.10 < 5.14
  - Linux 5.14
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:25.203'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90284'
references:
  - url: 'https://git.kernel.org/stable/c/5a250bff75a446374c05622973b18b4ab662b504'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6eaa632d0ed7bbb84f9cb670e5ec4e2cecf4cc7b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/85aeb8fc61839098ae0942ccba86e669c08e75d4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/93a2385730540105df8524447dcc11309ad280f9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b48373c901951fad1a26bd7c33ad91172b3945b5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c8b97c5130f27b64fa2cfe1aa4bebb13f724c6c7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ea33fac0df7fe7b49a4b27acb83e227b82317d1d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fb4824880b0dba0e7b3a497c46c642f979630392'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.834Z'
epss: 0.0021
epssPercentile: 0.10076
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

firmware_loader: do not queue completed sysfs fallback requests

fw_load_sysfs_fallback() calls device_add() before adding the fw_priv to
pending_fw_head. device_add() publishes the fallback loading interface, so
a userspace helper which discovers the device by scanning sysfs can write 0
to the loading attribute and complete the request before it is queued as
pending.

In that interleaving firmware_loading_store() calls fw_state_done() while
pending_list still points to itself, so it cannot remove an entry from
pending_fw_head. The subsequent unconditional list_add() then queues an
already-completed fw_priv. Once the request is released, pending_fw_head
can retain a pointer to freed memory and the next fallback request can
fault while validating the list.

Only in-flight fallback requests need suspend or reboot abort handling. If
the request is already DONE after device_add(), return success from the
fallback path without sending another uevent, waiting again, or queueing it
as pending. This preserves the invariant that pending_fw_head contains only
active fallback requests.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.