CVE-2026-90129

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the virtio balloon driver where the absence of a specific .shutdown handler allows the generic virtio bus shutdown process to break and reset the device while asynchronous work is still active. This causes the virtqueue add inbuf() function within virtballoon free page report() to return an -EIO error and trigger a WARN ON ONCE() condition. In environments configured with panic on warn, this sequence can lead to a fatal kernel panic during system reboot or kexec operations, preventing the system from successfully booting into a new kernel. Additionally, the inflate, deflate, and OOM (Out of Memory) paths may block indefinitely on a broken queue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.