CVE-2026-90404: platform/chrome: cros_ec_debugfs: Unregister panic notifier
In the Linux kernel, the following vulnerability has been resolved:
platform/chrome: crosecdebugfs: Unregister panic notifier
crosecdebugfsprobe() registers notifierpanic with the EC panic notifier chain. The remove path tears down debugfs and the console log, but leaves the notifier registered. A later panic notification can call back into the removed instance and queue work that accesses released data.
Unregister the panic notifier before tearing down the debugfs and console log state.
This issue was found by a static analysis tool.
Affected Software
Event History
Frequently Asked Questions
Under what conditions can the unsafe callback occur?
The cros_ec_debugfs instance must first be removed while its EC panic notifier remains registered. A subsequent panic notification can then invoke the stale callback.
What can happen after the affected instance is removed?
The stale notifier callback can queue work that accesses data that has already been released. The issue concerns teardown of the debugfs and console-log state.
What is the required fix behavior?
The panic notifier must be unregistered before the debugfs and console-log state are torn down. The provided references identify stable kernel commits containing the resolution.