CVE-2026-90284: firmware_loader: do not queue completed sysfs fallback requests
Published Sep 17, 2026
·Updated
firmwareloader: do not queue completed sysfs fallback requests
Affected Software
2 affected componentsFixes available
Linux Kernel
Microsoft azl3 kernel 6.6.152.1-1<6.6.157.1-1
6.6.157.1-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Sep 17, 2026
CVE Published
via MITRE·04:08 PM
Data Sourced
via MITRE·04:08 PM
Description
Data Sourced
via NVD·05:17 PM
Description
Sep 19, 2026
Data Sourced
via Microsoft·08:06 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·08:06 AM
DescriptionSeverity
Frequently Asked Questions
1
Which systems are exposed to this race condition?
Systems are exposed when the kernel uses the sysfs firmware fallback path and a userspace helper discovers the fallback device through sysfs quickly enough to write 0 to its loading attribute before the request is added to the pending-request list.
2
What is the likely operational impact if the race occurs?
A completed firmware request can be left on the pending list after its memory is released, leaving a freed-memory pointer. A later sysfs fallback request can fault while validating that list.