CVE-2026-90238

CVE-2026-90238

published September 17, 2026

CVSS
—
EPSS
0%
Percentile
9.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path

isp4sd_pwron_and_init() holds ops_mutex via guard(mutex) and, on any

init failure, jumps to err_deinit and calls isp4sd_pwroff_and_deinit().

That helper takes the same ops_mutex, re-acquiring a non-recursive mutex

already held by the current thread, so any init failure deadlocks.

Unwind the error path in stages instead, releasing only what each

failure point acquired. This also avoids the issues that an

unconditional teardown would hit at the earlier failures, such as a

runtime-PM underflow from pm_runtime_resume_and_get() and MMIO access

while the device is unpowered.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00198 · 9.0th percentile
Published
2026-09-17T21:17Z
References (2)
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 16:07Z
    media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path
    cvelistv5