Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-90360— regulator: core: use system_freezable_wq for init complete work

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： regulator：核心：使用 system_freezable_wq 处理初始化完成的工作项 使用的是非可冻结的 ，这使得 有可能与系统挂起（suspend）并发执行。该工作项在启动后约 30 秒触发，用于通过 I2C 禁用未使用的电压调节器（regulator）。当它与电源管理（PM）挂起发生竞态条件时，I2C 适配器可能已被挂起，从而在 中触发 警告： 修复方式：改用 ，确保该工作项在设备挂起前被冻结，从而消除竞态条件。

AI Predicted 5.0 Difficulty: Moderate EPSS 0.25% · P15

Possible ATT&CK Techniques 1 AI

T1055 · Process Injection

Affected Version Matrix 30

VendorProduct Version RangeStatus
Linux Linux 8b8c8d69b1a31004517d4c71a490f47bdf3405a2< 8a2ae3ab348cce44120667277c2198f10cc348b1 affected
d7ce17fba6c8e316ca9a554a87edddce6f862435< 350a0cba90e1bd40b1fe5b396923d2f3a61d1056 affected
55576cf1853798e86f620766e23b604c9224c19c< 2cebc00340a585adeffe321bc41f1937eb79a4dc affected
55576cf1853798e86f620766e23b604c9224c19c< 9cf65270c1c1717c84dcfacd58a782c1186b0cbf affected
55576cf1853798e86f620766e23b604c9224c19c< dc8570a5b830190bf0b57017c35aef97cd6ad7d9 affected
55576cf1853798e86f620766e23b604c9224c19c< 6d0a2c5e210f2fba099129e6183ef81316a6ae48 affected
55576cf1853798e86f620766e23b604c9224c19c< 0d23d658d79925076026fff62a49b8c94e0e8922 affected
55576cf1853798e86f620766e23b604c9224c19c< 0b950aa7ec95e120b2bde745ca9a7ed3ce49d528 affected
… +22 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90360

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
regulator: core: use system_freezable_wq for init complete work
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: regulator: core: use system_freezable_wq for init complete work schedule_delayed_work() uses system_wq, which is non-freezable, allowing regulator_init_complete_work to run concurrently with system suspend. This work fires ~30s after boot to disable unused regulators via I2C. When it races with PM suspend, the I2C adapter may already be suspended, triggering a -ESHUTDOWN warning in __i2c_transfer(): WARNING: ... at __i2c_transfer+0x36c/0x3c8 Call trace: __i2c_transfer i2c_transfer regmap_i2c_write _regmap_update_bits regulator_disable_regmap _regulator_do_disable regulator_late_cleanup regulator_init_complete_work_function process_one_work Switch to system_freezable_wq so the work is frozen before any device is suspended, eliminating the race.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 8b8c8d69b1a31004517d4c71a490f47bdf3405a2 ~ 8a2ae3ab348cce44120667277c2198f10cc348b1 -
Linux Linux 5.4 -

II. Public POCs for CVE-2026-90360

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90360

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-90360 (8)

Other References for CVE-2026-90360 (1)

Same Patch Batch · Linux · 2026-09-17 · 600 CVEs total

CVE-2026-90173 9.8 CRITICAL smb: smbdirect: free completion queues with ib_free_cq()
CVE-2026-92489 9.8 CRITICAL xfrm: Fix skb double-free in xfrm_dev_direct_output()
CVE-2026-90151 9.8 CRITICAL NFSv4: remove callback IDR entry on client allocation failure
CVE-2026-90235 9.8 CRITICAL sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
CVE-2026-90104 9.8 CRITICAL NFSv4.1: zero referring call lists before decoding
CVE-2026-90110 9.4 CRITICAL inetpeer: randomize RB-tree node comparison using SipHash
CVE-2026-90413 9.1 CRITICAL IB/isert: reject login PDUs declaring more data than was received
CVE-2026-90414 9.1 CRITICAL IB/isert: reject PDUs declaring more data than was received
CVE-2026-90230 9.1 CRITICAL nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
CVE-2026-90255 8.8 HIGH Bluetooth: hci_conn: fix the SCO setup context lifetime
CVE-2026-90329 8.8 HIGH HID: synchronize input before cleaning up a failed probe
CVE-2026-90357 8.8 HIGH wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
CVE-2026-90367 8.8 HIGH wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
CVE-2026-90256 8.8 HIGH Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
CVE-2026-90371 8.8 HIGH wifi: mt76: fix RXDMAD_C buffer recycling race
CVE-2026-93189 8.8 HIGH HID: core: quiesce input in hid_hw_stop() to prevent use-after-free
CVE-2026-90425 8.8 HIGH iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
CVE-2026-90240 8.8 HIGH iommu/vt-d: Flush context cache with correct SID when tearing down aliases
CVE-2026-90162 8.8 HIGH ksmbd: defer publishing granted locks to prevent UAF/double-free race
CVE-2026-90286 8.8 HIGH drm/amdgpu/gfx6: Use PFP on the compute queues too

Showing top 20 of 600 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90360

No comments yet

Leave a comment