Executive brief
The AMD ISP4 image signal processor driver in the Linux kernel contains a self-deadlock bug in its power-on error recovery path. When initialization fails, the error handler attempts to acquire a mutex that is already held by the calling function, causing the system to hang. This affects systems using AMD ISP4 hardware when device initialization encounters errors.
Technical details
The vulnerability is a deadlock (CWE-667) in the `isp4sd_pwron_and_init()` function within the AMD ISP4 media driver. The function holds `ops_mutex` via `guard(mutex)` and, on initialization failure, jumps to an error handler that calls `isp4sd_pwroff_and_deinit()`, which attempts to re-acquire the same non-recursive mutex. This causes a self-deadlock on any init failure. The fix replaces the monolithic error handler with staged unwinding that releases only the resources acquired up to each failure point, avoiding both the deadlock and resource cleanup issues (e.g., runtime-PM underflow, MMIO access while unpowered) that would occur with unconditional teardown. The fix is available in kernel commit ef46d80a7015269a98c9505b5912a83798799199.
Affected products
- Linux Linux kernel Affected versions prior to fix commit ef46d80a7015269a98c9505b5912a83798799199; backported to stable series
Timeline
- 2026-09-17: disclosed: CVE-2026-90238 published
- 2026-08-10: patched: Fix committed to mainline kernel (commit ef46d80a7015269a98c9505b5912a83798799199)
- 2026-09-14: patched: Fix backported to stable kernel series (commit 74669cc3483e9729ca26b4e06a096ccdd607db64)