CVE-2026-90421

A flaw was found in the Linux kernel's Peripheral Component Interconnect (PCI) subsystem. This Use-After-Free (UAF) vulnerability arises when a PCI device probe operation occurs concurrently with the removal of a dynamic ID. This timing issue could allow a local attacker to cause a system crash, leading to a denial of service, or potentially gain unauthorized access to sensitive information or execute arbitrary code.

This vulnerability is rated as Moderate impact because successful exploitation requires specific local timing constraints to trigger the race condition, restricting the potential blast radius to a localized denial of service. The flaw resides in the core PCI bus management code when dynamic hardware identifiers are deregistered while device matching executes. Triggering this race condition typically requires privileged access to write to driver sysfs interfaces alongside concurrent device enumeration, making spontaneous or unprivileged exploitation unlikely in standard enterprise environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.