CVE record · CVE-2026-90421

PCI: Fix UAF when probe runs concurrent to dyn ID removal

No CVSS scoreEPSS 0.0021 · 10th percentile

Published by the CVE Program (CNA: Linux) at 17 Sept 2026, 16:09 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Linux	Linux	affected 0994375e9614f78657031e04e30019b9cdb62795 to before 74133e74619d108eeaaa787d78906314d7a7b077 git affected 0994375e9614f78657031e04e30019b9cdb62795 to before d867db0a2602919510f346bc555f7b3093f6b6cc git affected 0994375e9614f78657031e04e30019b9cdb62795 to before 2cbcb0819c6367e1d5b0792a960594cc19576e23 git affected 0994375e9614f78657031e04e30019b9cdb62795 to before c36816feff47f676dcc51919777d483f4146c1ee git affected 0994375e9614f78657031e04e30019b9cdb62795 to before 42a5661ff7e4c7d3c5025d0f8e5079fb5479ea49 git affected 0994375e9614f78657031e04e30019b9cdb62795 to before 3ffc4c9690c33ee28cdb3d0182b12f9c623e3acc git Other versions: unaffected
Linux	Linux	affected 2.6.30 unaffected before 2.6.30 semver unaffected 6.1.191 to 6.1., inclusive semver unaffected 6.6.160 to 6.6., inclusive semver unaffected 6.12.114 to 6.12., inclusive semver unaffected 6.18.57 to 6.18., inclusive semver unaffected 7.2.6 to 7.2., inclusive semver unaffected 7.3 to , inclusive original_commit_for_fix Other versions: affected

Identifiers: CVE-2026-90421
CNA: Linux
Tags: Linux kernel
Published: 17 Sept 2026
Updated: 30 Oct 2026

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

The Linux kernel PCI subsystem has a use-after-free when a device probe runs concurrently with removal of a dynamic device ID, which can free memory still in use. Affected versions start at 2.6.30. The source gives few details on attacker requirements or impact; upgrade to 6.1.191, 6.6.160, 6.12.114, 6.18.57 or later in the matching series.

Written 12 Nov 2026.

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

No source has published a CVSS score for this record yet.

CISA KEV Not listed.
EPSS 0.0021, the 10th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 17 Sept 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.