CVE record · CVE-2026-90284

firmware_loader: do not queue completed sysfs fallback requests

No CVSS scoreEPSS 0.0022 · 12th percentile

Published by the CVE Program (CNA: Linux) at 17 Sept 2026, 16:08 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Linux	Linux	affected ecb739cf15a9bae040ce6b60209b78b92512d120 to before c8b97c5130f27b64fa2cfe1aa4bebb13f724c6c7 git affected 75d95e2e39b27f733f21e6668af1c9893a97de5e to before 93a2385730540105df8524447dcc11309ad280f9 git affected 75d95e2e39b27f733f21e6668af1c9893a97de5e to before ea33fac0df7fe7b49a4b27acb83e227b82317d1d git affected 75d95e2e39b27f733f21e6668af1c9893a97de5e to before 5a250bff75a446374c05622973b18b4ab662b504 git affected 75d95e2e39b27f733f21e6668af1c9893a97de5e to before 85aeb8fc61839098ae0942ccba86e669c08e75d4 git affected 75d95e2e39b27f733f21e6668af1c9893a97de5e to before 6eaa632d0ed7bbb84f9cb670e5ec4e2cecf4cc7b git affected 75d95e2e39b27f733f21e6668af1c9893a97de5e to before fb4824880b0dba0e7b3a497c46c642f979630392 git affected 75d95e2e39b27f733f21e6668af1c9893a97de5e to before b48373c901951fad1a26bd7c33ad91172b3945b5 git affected 67cf0fbcac0d42d4d4686cddc1e39f465bbfec37 git affected d09639528b66b5c7c20dc8f7fb8928aacabd40bb git affected c14a54675db7131791402fa22fb0fa6da1f5fb66 git affected 5.10.58 to before 5.10.270 semver and 3 more Other versions: unaffected
Linux	Linux	affected 5.14 unaffected before 5.14 semver unaffected 5.10.270 to 5.10., inclusive semver unaffected 5.15.221 to 5.15., inclusive semver unaffected 6.1.188 to 6.1., inclusive semver unaffected 6.6.157 to 6.6., inclusive semver unaffected 6.12.110 to 6.12., inclusive semver unaffected 6.18.52 to 6.18., inclusive semver unaffected 7.2.6 to 7.2., inclusive semver unaffected 7.3 to , inclusive original_commit_for_fix Other versions: affected

Identifiers: CVE-2026-90284
CNA: Linux
Tags: Linux kernel
Published: 17 Sept 2026
Updated: 19 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

No source has published a CVSS score for this record yet.

CISA KEV Not listed.
EPSS 0.0022, the 12th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 17 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.