CVE-2026-90360: regulator: core: use system_freezable_wq for init complete work
In the Linux kernel, the following vulnerability has been resolved:
regulator: core: use systemfreezablewq for init complete work
scheduledelayedwork() uses systemwq, which is non-freezable, allowing regulatorinitcompletework to run concurrently with system suspend. This work fires ~30s after boot to disable unused regulators via I2C. When it races with PM suspend, the I2C adapter may already be suspended, triggering a -ESHUTDOWN warning in i2ctransfer():
WARNING: ... at i2ctransfer+0x36c/0x3c8 Call trace: i2ctransfer i2ctransfer regmapi2cwrite regmapupdatebits regulatordisableregmap regulatordodisable regulatorlatecleanup regulatorinitcompleteworkfunction processonework
Switch to systemfreezablewq so the work is frozen before any device is suspended, eliminating the race.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Switch regulator core init/cleanup delayed work from system_wq to system_freezable_wq so work is frozen before PM suspend, preventing the race in __i2c_transfer / regmap_i2c_write during suspend.
Linux kernel regulator: core workqueue used by regulator_init_complete_work (schedule_delayed_work) = system_freezable_wq
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
Linux systems using the regulator framework where delayed regulator initialization cleanup can disable unused regulators over I2C are exposed. The race is relevant when a system suspend occurs while the initialization-complete work runs, approximately 30 seconds after boot.
What is required to trigger the issue?
A suspend operation must overlap with regulator_init_complete_work. During that overlap, the work may attempt an I2C transfer after the I2C adapter has already been suspended, resulting in a -ESHUTDOWN warning.
How can I identify whether the issue has occurred?
Check kernel logs for a WARNING in __i2c_transfer() with a call trace including regulator_init_complete_work_function, regulator_late_cleanup, regulator_disable_regmap, and regmap_i2c_write. The I2C transfer failure is reported as -ESHUTDOWN.
What mitigation is described if an update cannot be applied immediately?
The provided information does not specify an operational workaround. The resolution is to schedule the work on system_freezable_wq so it is frozen before devices are suspended.