{"id":"CVE-2026-90284","revision":"b98e144f3f8a481fba1da7942a829e7c","records":[{"revision":"b98e144f3f8a481fba1da7942a829e7c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90284","aliases":[],"title":"firmware_loader: do not queue completed sysfs fallback requests","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware_loader: do not queue completed sysfs fallback requests\n\nfw_load_sysfs_fallback() calls device_add() before adding the fw_priv to\npending_fw_head. device_add() publishes the fallback loading interface, so\na userspace helper which discovers the device by scanning sysfs can write 0\nto the loading attribute and complete the request before it is queued as\npending.\n\nIn that interleaving firmware_loading_store() calls fw_state_done() while\npending_list still points to itself, so it cannot remove an entry from\npending_fw_head. The subsequent unconditional list_add() then queues an\nalready-completed fw_priv. Once the request is released, pending_fw_head\ncan retain a pointer to freed memory and the next fallback request can\nfault while validating the list.\n\nOnly in-flight fallback requests need suspend or reboot abort handling. If\nthe request is already DONE after device_add(), return success from the\nfallback path without sending another uevent, waiting again, or queueing it\nas pending. This preserves the invariant that pending_fw_head contains only\nactive fallback requests.","state":0,"publishedAt":"2026-09-17T16:08:13.993+00:00","modifiedAt":"2026-10-19T09:01:02.825+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/base/firmware_loader/fallback.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ecb739cf15a9bae040ce6b60209b78b92512d120\",\n                            \"lessThan\": \"c8b97c5130f27b64fa2cfe1aa4bebb13f724c6c7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"75d95e2e39b27f733f21e6668af1c9893a97de5e\",\n                            \"lessThan\": \"93a2385730540105df8524447dcc11309ad280f9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"75d95e2e39b27f733f21e6668af1c9893a97de5e\",\n                            \"lessThan\": \"ea33fac0df7fe7b49a4b27acb83e227b82317d1d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"75d95e2e39b27f733f21e6668af1c9893a97de5e\",\n                            \"lessThan\": \"5a250bff75a446374c05622973b18b4ab662b504\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"75d95e2e39b27f733f21e6668af1c9893a97de5e\",\n                            \"lessThan\": \"85aeb8fc61839098ae0942ccba86e669c08e75d4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"75d95e2e39b27f733f21e6668af1c9893a97de5e\",\n                            \"lessThan\": \"6eaa632d0ed7bbb84f9cb670e5ec4e2cecf4cc7b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"75d95e2e39b27f733f21e6668af1c9893a97de5e\",\n                            \"lessThan\": \"fb4824880b0dba0e7b3a497c46c642f979630392\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"75d95e2e39b27f733f21e6668af1c9893a97de5e\",\n                            \"lessThan\": \"b48373c901951fad1a26bd7c33ad91172b3945b5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"67cf0fbcac0d42d4d4686cddc1e39f465bbfec37\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d09639528b66b5c7c20dc8f7fb8928aacabd40bb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c14a54675db7131791402fa22fb0fa6da1f5fb66\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.10.58\",\n                            \"lessThan\": \"5.10.270\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"4.19.203\",\n                            \"lessThan\": \"4.20\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.140\",\n                            \"lessThan\": \"5.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.13.10\",\n                            \"lessThan\": \"5.14\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/base/firmware_loader/fallback.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.14\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.14\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/c8b97c5130f27b64fa2cfe1aa4bebb13f724c6c7","https://git.kernel.org/stable/c/93a2385730540105df8524447dcc11309ad280f9","https://git.kernel.org/stable/c/ea33fac0df7fe7b49a4b27acb83e227b82317d1d","https://git.kernel.org/stable/c/5a250bff75a446374c05622973b18b4ab662b504","https://git.kernel.org/stable/c/85aeb8fc61839098ae0942ccba86e669c08e75d4","https://git.kernel.org/stable/c/6eaa632d0ed7bbb84f9cb670e5ec4e2cecf4cc7b","https://git.kernel.org/stable/c/fb4824880b0dba0e7b3a497c46c642f979630392","https://git.kernel.org/stable/c/b48373c901951fad1a26bd7c33ad91172b3945b5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90284","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90284","identifiers":["CVE-2026-90284"]},"retained":false,"historicalAffected":[]}],"coverage":[]}