Executive brief
The Linux kernel's s390/debug subsystem (a diagnostic facility for IBM System z architecture) could hang indefinitely (deadlock) when unregistering a debug area while a debugfs file is being written to simultaneously. This affects any system running affected kernel versions, potentially causing system hangs or crashes during module unload operations.
Technical details
The vulnerability is a deadlock condition in the s390/debug subsystem's unregister path. When debug_unregister() is called while a debugfs file write is in progress, the function attempts to acquire debug_mutex while holding debugfs locks, while the concurrent debugfs write operation holds the opposite lock order—causing a classic ABBA deadlock. The fix separates the debugfs cleanup (_debug_unregister_debugfs) from the internal list management (_debug_unregister), ensuring only the list management operates under debug_mutex lock, breaking the circular dependency. This is a local denial-of-service issue on s390 systems requiring kernel module unload operations coinciding with active debugfs writes—no authentication or network access required.
Affected products
- Linux Linux kernel Multiple versions (exact range dependent on backport history)
Timeline
- 2026-09-17: disclosed: CVE-2026-90209 published
- 2026-08-12: patched: Upstream commit 445c31ac638fd1af203d79bdf25fc0cb3149fbbc merged