CVE-2026-90158
In the Linux kernel, the following vulnerability has been resolved: m68k: nfcon: Do not call console_is_registered() in nfcon_device() Since 7c2af0f634f1 ("tty: tty_io: use console_list_lock for list synchronization") show_cons_active() calls the .device() method under the console_list_lock, but console_is_registered() tries to acquire console_list_lock as well, causing a deadlock. It should not be necessary to check console_is_registered() here since the function should not be called in the fist place when the console is not registered.
Affected versions
Linux kernel versions
6.2
and later are affected. Fixed in
6.6.157,
6.12.110,
6.18.52,
7.2.6,
7.3-rc1
and their respective stable series.
References
5 totalFrequently asked questions
-
What is CVE-2026-90158?
CVE-2026-90158 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.2 onward and has been patched in 6.6.157, 6.12.110, 6.18.52 and others. CVE-2026-90158 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-90158?
Yes. CVE-2026-90158 has been patched. Fixed versions include 6.6.157, 6.12.110, 6.18.52 and others. If you are running Linux kernel 6.2 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-90158 actively exploited?
No. CVE-2026-90158 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.