CVE-2026-90209

Summary

In the Linux kernel, the following vulnerability has been resolved:

s390/debug: Fix deadlock during unregister

Unregistering an s390dbf debug area while one of the associated debugfs files is being written to can cause a deadlock:

$ echo >…/vmur/level $ rmmod vmur

debugfs write debugfs_file_get() debug_unregister() mutex_lock(debug_mutex) debugfs_remove() wait for debugfs_file_put() debug_file_ops.write() debug_input() mutex_lock(debug_mutex) ==> DEADLOCK

Fix this by splitting debug_unregister() into an s390dbf and debugfs part, and running only the s390dbf part with debug_mutex locked.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux9372a82892c2caa6bccab9a4081166fa769699f8 < a214c3dacc779b2afcb0ac9c8001e45ee4ffb2edaffected
LinuxLinux9372a82892c2caa6bccab9a4081166fa769699f8 < 183f8f6d64bb0510070c856b9927618c53014a7baffected
LinuxLinux9372a82892c2caa6bccab9a4081166fa769699f8 < a08b70ed2d1ec907353a72f15163b8e34ff4b2f8affected
LinuxLinux9372a82892c2caa6bccab9a4081166fa769699f8 < 45bb341d1b73eb293e0dd43d9b72bbc8b615d0baaffected
LinuxLinux9372a82892c2caa6bccab9a4081166fa769699f8 < 5d83f3faa3fb7f23f298cfd40382611999de5d1daffected
LinuxLinux9372a82892c2caa6bccab9a4081166fa769699f8 < 54e1259b75d6402a1d0cfb822b9bb2c507e53dabaffected
LinuxLinux9372a82892c2caa6bccab9a4081166fa769699f8 < 445c31ac638fd1af203d79bdf25fc0cb3149fbbcaffected
LinuxLinuxc68ba4a708fbd0efdc384cd29250bb292a45e559affected
LinuxLinux86f9980909f31ab205323eeeb290fe3cbb4952b4affected
LinuxLinuxfe5793e90d3f572a87ba67fe2f0e1679fdff14f8affected
LinuxLinuxe234f66168f0d50c0d28154fb983a14e85c3c526affected
LinuxLinux5.4.146 < 5.5affected
LinuxLinux5.10.65 < 5.11affected
LinuxLinux5.13.17 < 5.14affected
LinuxLinux5.14.4 < 5.15affected
LinuxLinux5.15affected
LinuxLinux0 < 5.15unaffected
LinuxLinux5.15.221 <= 5.15.*unaffected
LinuxLinux6.1.188 <= 6.1.*unaffected
LinuxLinux6.6.157 <= 6.6.*unaffected
LinuxLinux6.12.110 <= 6.12.*unaffected
LinuxLinux6.18.52 <= 6.18.*unaffected
LinuxLinux7.2.6 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References