Re: CVE-2026-90310: xen/xenbus: check otherend_id only after it has been initialized

[Jürgen Groß]

On 17.09.26 18:12, Greg Kroah-Hartman wrote:
> From: Greg Kroah-Hartman <gregkh@xxxxxxxxxx>
>
> Description
> ===========
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> xen/xenbus: check otherend_id only after it has been initialized
>
> When device just got initialized (for example on module load), the
> otherend_id field is initialized only after
> xenbus_read_otherend_details() gets called. If xenstore watch triggers
> xenbus_dev_changed() before that, it might consider still zeroed
> otherend_id field (not matching actual xenstore content) as a sign of
> device state reset. It can happen because xenstore watch are handled in
> another thread (xenwatch), which can run in parallel to the initial
> device probe running at module load. In that case, it would call
> device_unregister(), which would deadlock against device probe from
> module init.
>
> Fix this by considering dev->otherend_id change only after dev->otherend
> is set (which happen after otherend_id is initialized).
>
> The Linux kernel CVE team has assigned CVE-2026-90310 to this issue.

I'd like to dispute this CVE.

This is nothing an unprivileged user has any influence on. The race can
happen only in Xen guests after a new PV-device has been added to it by the
host administrator.

This is just a regular bug with no security aspect, so please revoke this CVE.


Juergen

Attachment: OpenPGP_0xB0DE9DD628BF132F.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature