CVE-2026-90360

CVE-2026-90360

published September 17, 2026

CVSS
—
EPSS
0%
Percentile
14.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

regulator: core: use system_freezable_wq for init complete work

schedule_delayed_work() uses system_wq, which is non-freezable, allowing

regulator_init_complete_work to run concurrently with system suspend. This

work fires ~30s after boot to disable unused regulators via I2C. When it

races with PM suspend, the I2C adapter may already be suspended, triggering

a -ESHUTDOWN warning in __i2c_transfer():

WARNING: ... at __i2c_transfer+0x36c/0x3c8

Call trace:

__i2c_transfer

i2c_transfer

regmap_i2c_write

_regmap_update_bits

regulator_disable_regmap

_regulator_do_disable

regulator_late_cleanup

regulator_init_complete_work_function

process_one_work

Switch to system_freezable_wq so the work is frozen before any device

is suspended, eliminating the race.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00245 · 14.9th percentile
Published
2026-09-17T21:17Z
References (10)
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 16:09Z
    regulator: core: use system_freezable_wq for init complete work
    cvelistv5