{"cve":"CVE-2026-90209","nvd":{"published":"2026-09-17T17:17:16.060","modified":"2026-10-19T09:19:11.057","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/debug: Fix deadlock during unregister\n\nUnregistering an s390dbf debug area while one of the associated debugfs\nfiles is being written to can cause a deadlock:\n\n$ echo >.../vmur/level    $ rmmod vmur\n===================================================\ndebugfs write\ndebugfs_file_get()\n                          debug_unregister()\n                          mutex_lock(debug_mutex)\n                          debugfs_remove()\n                          wait for debugfs_file_put()\ndebug_file_ops.write()\ndebug_input()\nmutex_lock(debug_mutex) ==> DEADLOCK\n\nFix this by splitting debug_unregister() into an s390dbf and debugfs\npart, and running only the s390dbf part with debug_mutex locked.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/183f8f6d64bb0510070c856b9927618c53014a7b","https://git.kernel.org/stable/c/445c31ac638fd1af203d79bdf25fc0cb3149fbbc","https://git.kernel.org/stable/c/45bb341d1b73eb293e0dd43d9b72bbc8b615d0ba","https://git.kernel.org/stable/c/54e1259b75d6402a1d0cfb822b9bb2c507e53dab","https://git.kernel.org/stable/c/5d83f3faa3fb7f23f298cfd40382611999de5d1d"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-90209","score":0.00215,"percentile":0.11729,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}