CVE-2026-90158

CVE-2026-90158

published September 17, 2026

CVSS
—
EPSS
0%
Percentile
10.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

m68k: nfcon: Do not call console_is_registered() in nfcon_device()

Since 7c2af0f634f1 ("tty: tty_io: use console_list_lock for list

synchronization") show_cons_active() calls the .device() method under

the console_list_lock, but console_is_registered() tries to acquire

console_list_lock as well, causing a deadlock. It should not be

necessary to check console_is_registered() here since the function

should not be called in the fist place when the console is not

registered.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00209 · 10.5th percentile
Published
2026-09-17T21:17Z
References (5)
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 16:06Z
    m68k: nfcon: Do not call console_is_registered() in nfcon_device()
    cvelistv5