CVE-2026-90284

A flaw was found in the Linux kernel's firmware loader. Due to improper handling of sysfs fallback requests, a race condition can occur where a userspace helper completes a request before it is properly queued. This can lead to the system retaining a pointer to freed memory, potentially causing a system crash or denial of service when processing subsequent firmware requests.

A race in the firmware_loader sysfs fallback path can queue a firmware request after it has already been completed by userspace. device_add exposes the loading attribute before fw_priv is linked into pending_fw_head, so a userspace helper can write 0 to loading and cause fw_state_done to run first. The later unconditional list_add can leave pending_fw_head containing an already completed fw_priv and after release this may become a stale pointer to freed memory. The next fallback request can fault while validating the list, giving at least a local denial of service. For the CVSS the PR:L is used for the paranoid score because a local user or service account may be able to influence firmware fallback handling through the sysfs loading interface in some deployments, although reliable triggering usually depends on local firmware helper behavior. The issue is not network reachable. Impact is at least local denial of service and in worst case may allow confidentiality or integrity impact due to use-after-free memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.