CVE-2026-90310
In the Linux kernel, the following vulnerability has been resolved: xen/xenbus: check otherend_id only after it has been initialized When device just got initialized (for example on module load), the otherend_id field is initialized only after xenbus_read_otherend_details() gets called. If xenstore watch triggers xenbus_dev_changed() before that, it might consider still zeroed otherend_id field (not matching actual xenstore content) as a sign of device state reset. It can happen because xenstore watch are handled in another thread (xenwatch), which can run in parallel to the initial device probe running at module load. In that case, it would call device_unregister(), which would deadlock against device probe from module init. Fix this by considering dev->otherend_id change only after dev->otherend is set (which happen after otherend_id is initialized).
Affected versions
Linux kernel versions
7.0
and later are affected. Fixed in
7.2.6,
7.3-rc1
and their respective stable series.
References
2 totalFrequently asked questions
-
What is CVE-2026-90310?
CVE-2026-90310 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 7.0 onward and has been patched in 7.2.6 and 7.3-rc1. CVE-2026-90310 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-90310?
Yes. CVE-2026-90310 has been patched. Fixed versions include 7.2.6 and 7.3-rc1. If you are running Linux kernel 7.0 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-90310 actively exploited?
No. CVE-2026-90310 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.