CVE-2026-90209 s390/debug: Fix deadlock during unregister
A race condition in the Linux kernel s390 debug subsystem can cause a deadlock during module unregistration, leading to a local denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90209?
CVE-2026-90209 is a vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
s390/debug: Fix deadlock during unregister
Unregistering an s390dbf debug area while one of the associated debugfs files is being written to can cause a deadlock:
$ echo >.../vmur/level $ rmmod vmur =================================================== debugfs write debugfs_file_get() debug_unregister() mutex_lock(debug_mutex) debugfs_remove() wait for debugfs_file_put() debug_file_ops.write() debug_input() mutex_lock(debug_mutex) ==> DEADLOCK
Fix this by splitting debug_unregister() into an s390dbf and debugfs part, and running only the s390dbf part with debug_mutex locked.
Which versions are affected by CVE-2026-90209?
How do I fix CVE-2026-90209?
Apply the vendor's patch.
Is CVE-2026-90209 being exploited?
There is no known exploitation of CVE-2026-90209 in the wild and no public exploit code.
Sources
Also known as AZL-102368, BELL-CVE-2026-90209, DEBIAN-CVE-2026-90209, GHSA-5fhq-j2h9-6qrx, UBUNTU-CVE-2026-90209.