CVE-2026-90404 (GCVE-0-2026-90404)
Vulnerability from cvelistv5
Published
2026-09-17 16:09
Modified
2026-10-19 09:03
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_debugfs: Unregister panic notifier cros_ec_debugfs_probe() registers notifier_panic with the EC panic notifier chain. The remove path tears down debugfs and the console log, but leaves the notifier registered. A later panic notification can call back into the removed instance and queue work that accesses released data. Unregister the panic notifier before tearing down the debugfs and console log state. This issue was found by a static analysis tool.
References
Impacted products
Vendor Product Version
Linux Linux Version: d90fa2c64d59f5f151beeef5dbc599784b3391ca
Version: d90fa2c64d59f5f151beeef5dbc599784b3391ca
Version: d90fa2c64d59f5f151beeef5dbc599784b3391ca
Version: d90fa2c64d59f5f151beeef5dbc599784b3391ca
Version: d90fa2c64d59f5f151beeef5dbc599784b3391ca
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/chrome/cros_ec_debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "56989e2a9c292ff7689603feed41d030301ca636",
              "status": "affected",
              "version": "d90fa2c64d59f5f151beeef5dbc599784b3391ca",
              "versionType": "git"
            },
            {
              "lessThan": "a5d3128b06ccfc398c2e456fddebadce52310bd8",
              "status": "affected",
              "version": "d90fa2c64d59f5f151beeef5dbc599784b3391ca",
              "versionType": "git"
            },
            {
              "lessThan": "e2cbe14361d7cb0b5abd66d87f3afa0e16efde9f",
              "status": "affected",
              "version": "d90fa2c64d59f5f151beeef5dbc599784b3391ca",
              "versionType": "git"
            },
            {
              "lessThan": "05c1081ae4503e45b934b390350f942db3208892",
              "status": "affected",
              "version": "d90fa2c64d59f5f151beeef5dbc599784b3391ca",
              "versionType": "git"
            },
            {
              "lessThan": "e5954d3031fb55dd31aa59bae477d63c68e941c0",
              "status": "affected",
              "version": "d90fa2c64d59f5f151beeef5dbc599784b3391ca",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/platform/chrome/cros_ec_debugfs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nplatform/chrome: cros_ec_debugfs: Unregister panic notifier\n\ncros_ec_debugfs_probe() registers notifier_panic with the EC panic\nnotifier chain. The remove path tears down debugfs and the console log,\nbut leaves the notifier registered. A later panic notification can call\nback into the removed instance and queue work that accesses released\ndata.\n\nUnregister the panic notifier before tearing down the debugfs and\nconsole log state.\n\nThis issue was found by a static analysis tool."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:03:08.821Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/56989e2a9c292ff7689603feed41d030301ca636"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5d3128b06ccfc398c2e456fddebadce52310bd8"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2cbe14361d7cb0b5abd66d87f3afa0e16efde9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/05c1081ae4503e45b934b390350f942db3208892"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5954d3031fb55dd31aa59bae477d63c68e941c0"
        }
      ],
      "title": "platform/chrome: cros_ec_debugfs: Unregister panic notifier",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90404",
    "datePublished": "2026-09-17T16:09:33.472Z",
    "dateReserved": "2026-09-11T19:38:34.811Z",
    "dateUpdated": "2026-10-19T09:03:08.821Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.