CVE-2026-90310

Published Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved: xen/xenbus: check otherend_id only after it has been initialized When device just got initialized (for example on module load), the otherend_id field is initialized only after xenbus_read_otherend_details() gets called. If xenstore watch triggers xenbus_dev_changed() before that, it might consider still zeroed otherend_id field (not matching actual xenstore content) as a sign of device state reset. It can happen because xenstore watch are handled in another thread (xenwatch), which can run in parallel to the initial device probe running at module load. In that case, it would call device_unregister(), which would deadlock against device probe from module init. Fix this by considering dev->otherend_id change only after dev->otherend is set (which happen after otherend_id is initialized).

Is your site exposed to CVE-2026-90310?

Run a free security scan — no signup, results in seconds.

References

Frequently Asked Questions

What is CVE-2026-90310? +
In the Linux kernel, the following vulnerability has been resolved: xen/xenbus: check otherend_id only after it has been initialized When device just got initialized (for example on module load), the otherend_id field is initialized only after xenbus_read_otherend_details() gets called. If xenstore watch triggers xenbus_dev_changed() before that, it might consider still zeroed otherend_id field (not matching actual xenstore content) as a sign of device state reset. It can happen because xenstore watch are handled in another thread (xenwatch), which can run in parallel to the initial device probe running at module load. In that case, it would call device_unregister(), which would deadlock against device probe from module init. Fix this by considering dev->otherend_id change only after dev->otherend is set (which happen after otherend_id is initialized).
How do I check if I'm vulnerable to CVE-2026-90310? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2026-90310 — free, no signup required.