CVE-2026-90310

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the xenbus component of the Linux kernel during device initialization. The otherend id field is initialized only after the xenbus read otherend details() function is called. If a xenstore watch triggers the xenbus dev changed() function before this initialization occurs, the system may incorrectly interpret the zeroed otherend id field as a device state reset. This occurs because xenstore watches are handled by a separate thread (xenwatch) that can run concurrently with the initial device probe during module load. Consequently, the system may call device unregister(), leading to a deadlock against the device probe from the module initialization.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.