Junglewise Threat Intelligence

CVE-2026-90431: Linux kernel remoteproc use-after-free in crash handler

CVE-2026-90431 · Severity: info · CVSS 4.1 · Published 2026-09-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's remoteproc (remote processor) subsystem had a race condition where driver removal could occur while crash-handling work was scheduled or executing, leading to use-after-free memory errors. This could cause system instability or crashes in systems managing remote processors (common in embedded devices and SoCs with coprocessors). The fix adds synchronization to ensure crash-handler work is properly cancelled before driver removal completes.

Technical details

The vulnerability is a race condition in the remoteproc core between rproc_crash_handler_work() and rproc_del(). When a remoteproc driver was removed, there was no synchronization to prevent crash-handler work from executing after memory was freed, resulting in use-after-free. The fix introduces a "deleting" flag that is checked in atomic-safe contexts (since rproc_report_crash() can be called atomically) to prevent new work scheduling during deletion, combined with cancellation and synchronization of pending work. Additionally, the fix properly handles the pm_stay_awake() balance when work is cancelled. The patch modifies drivers/remoteproc/remoteproc_core.c to add these synchronization checks and a spin lock initialization for crash_handler_lock.

Affected products

  • Linux Linux kernel 5.0 and later (prior to patch commit 74ee3b2f5767447c57959994341e5b95f1079977)

Timeline

  • 2026-09-17: disclosed: Published to NVD
  • 2026-07-23: patched: Fix committed upstream by Bjorn Andersson
  • 2026-09-14: other: Fix added to stable kernel tree

References

Related threats