CVE-2026-90158

Not scored yetLast modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

m68k: nfcon: Do not call console_is_registered() in nfcon_device()

Since 7c2af0f634f1 ("tty: tty_io: use console_list_lock for list synchronization") show_cons_active() calls the .device() method under the console_list_lock, but console_is_registered() tries to acquire console_list_lock as well, causing a deadlock. It should not be necessary to check console_is_registered() here since the function should not be called in the fist place when the console is not registered.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 7c2af0f634f1bc761ca827310dc7e8e586af502f, < 7d3f15a664d115584fc177b5f2cfbdb3e5a50d60; >= 7c2af0f634f1bc761ca827310dc7e8e586af502f, < e5e11274b5512e24a346ed83f8dd85e3389d2f4b; >= 7c2af0f634f1bc761ca827310dc7e8e586af502f, < be98f92fc244688a6bdecbc834cf2cd243056d9d; >= 7c2af0f634f1bc761ca827310dc7e8e586af502f, < d73441232f1f067eb659e94447b1353c16609711; >= 7c2af0f634f1bc761ca827310dc7e8e586af502f, < 2f8e3cad53b5c36ab0ed5d3195bfc55c59ea61a5
LinuxLinux6.2

References

Timeline

Published
Sep 17, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-90159In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks _bpf_sCVE-2026-90165.3The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Improper Output Neutralization for LogCVE-2026-90160In the Linux kernel, the following vulnerability has been resolved: lwt_bpf: Restore reserved headroom after xmit program ip_finish_outputCVE-2026-901617.1In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlacCVE-2026-901628.8In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer publishing granted locks to prevent UAF/double-free race CVE-2026-90163In the Linux kernel, the following vulnerability has been resolved: smb/server: call ksmbd_proc_cleanup() on module init failure When a laCVE-2026-90164In the Linux kernel, the following vulnerability has been resolved: smb/server: abort initialization when proc setup fails ksmbd_server_inCVE-2026-90165In the Linux kernel, the following vulnerability has been resolved: smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scaveCVE-2026-90166In the Linux kernel, the following vulnerability has been resolved: smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request() SeeCVE-2026-90167In the Linux kernel, the following vulnerability has been resolved: ksmbd: serialize oplock close with pending break ownership close may aCVE-2026-90169In the Linux kernel, the following vulnerability has been resolved: ksmbd: free preauth sessions on connection teardown SMB3.1.1 multichanCVE-2026-90175.3The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and in
CVE-2026-90158: Unscored | Vulnix