CVE-2026-90158 m68k: nfcon: Do not call console_is_registered() in nfcon_device()
A deadlock in the Linux kernel m68k nfcon driver causes a denial of service when console registration functions are called concurrently.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90158?
CVE-2026-90158 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
m68k: nfcon: Do not call console_is_registered() in nfcon_device()
Since 7c2af0f634f1 ("tty: tty_io: use console_list_lock for list synchronization") show_cons_active() calls the .device() method under the console_list_lock, but console_is_registered() tries to acquire console_list_lock as well, causing a deadlock. It should not be necessary to check console_is_registered() here since the function should not be called in the fist place when the console is not registered.
Which versions are affected by CVE-2026-90158?
How do I fix CVE-2026-90158?
Apply the vendor's patch.
Is CVE-2026-90158 being exploited?
There is no known exploitation of CVE-2026-90158 in the wild and no public exploit code.
Sources
Also known as AZL-102012, BELL-CVE-2026-90158, DEBIAN-CVE-2026-90158, GHSA-fwv7-hfpv-34gj, UBUNTU-CVE-2026-90158.