CVE-2026-90431

A flaw was found in the Linux kernel's remoteproc component. A race condition exists between the crash handling and removal functions due to a lack of synchronization. This could allow a local attacker to trigger a use-after-free vulnerability. Successful exploitation of this flaw may lead to system instability or a denial of service.

This vulnerability is classified as having Moderate severity for Red Hat products because triggering the condition requires local system access, and the scope of impact is restricted to a denial of service through kernel memory corruption. Standard server deployments rarely utilize the remote processor subsystem, leaving the affected driver uninitialized in typical enterprise environments. Exploitation specifically depends on concurrent driver unregistration during active error handling on platforms equipped with remote coprocessors, limiting the realistic attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.