---
id: CVE-2026-90421
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  PCI: Fix UAF when probe runs concurrent to dyn ID removal

  Dynamic IDs are only guaranteed to be valid when dynids.lock is held,
  as remove_id_store() can free the node.…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  PCI: Fix UAF when probe runs concurrent to dyn ID removal

  Dynamic IDs are only guaranteed to be valid when dynids.lock is held,
  as remove_id_store() can free the node.…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0994375e9614f78657031e04e30019b9cdb62795 <
    42a5661ff7e4c7d3c5025d0f8e5079fb5479ea49
  - >-
    Linux >= 0994375e9614f78657031e04e30019b9cdb62795 <
    3ffc4c9690c33ee28cdb3d0182b12f9c623e3acc
  - Linux 2.6.30
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:46.623'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90421'
references:
  - url: 'https://git.kernel.org/stable/c/3ffc4c9690c33ee28cdb3d0182b12f9c623e3acc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/42a5661ff7e4c7d3c5025d0f8e5079fb5479ea49'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.794Z'
epss: 0.00198
epssPercentile: 0.085
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

PCI: Fix UAF when probe runs concurrent to dyn ID removal

Dynamic IDs are only guaranteed to be valid when dynids.lock is held,
as remove_id_store() can free the node. Thus, make a copy in
pci_match_device(). Also, clarify that the id parameter is only valid
during probe.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.