Is there a patch available for CVE-2026-90360?

Yes, a patch is available for CVE-2026-90360. Update the affected software to the latest version immediately.

Linux CVE-2026-90360

EUVD-2026-82021

2026-09-17 Linux

Information Disclosure Linux

Lifecycle Timeline

Patch available

Sep 17, 2026 - 17:19 EUVD

CVE Published

Sep 17, 2026 - 16:09 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

regulator: core: use system_freezable_wq for init complete work

schedule_delayed_work() uses system_wq, which is non-freezable, allowing regulator_init_complete_work to run concurrently with system suspend. This work fires ~30s after boot to disable unused regulators via I2C. When it races with PM suspend, the I2C adapter may already be suspended, triggering a -ESHUTDOWN warning in __i2c_transfer():

WARNING: ... at __i2c_transfer+0x36c/0x3c8 Call trace: __i2c_transfer i2c_transfer regmap_i2c_write _regmap_update_bits regulator_disable_regmap _regulator_do_disable regulator_late_cleanup regulator_init_complete_work_function process_one_work

Switch to system_freezable_wq so the work is frozen before any device is suspended, eliminating the race.

Analysis

In the Linux kernel, the following vulnerability has been resolved: regulator: core: use system_freezable_wq for init complete work schedule_delayed_work() uses system_wq, which is non-freezable, allowing regulator_init_complete_work to run concurrently with system suspend. This work fires ~30s after boot to disable unused regulators via I2C. …