Bug 2536221 (CVE-2026-90360) - CVE-2026-90360 kernel: regulator: core: use system_freezable_wq for init complete work
Summary: CVE-2026-90360 kernel: regulator: core: use system_freezable_wq for init comp...
Keywords:
Status: NEW
Alias: CVE-2026-90360
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-17 16:58 UTC by OSIDB Bzimport
Modified: 2026-10-20 10:54 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-17 16:58:58 UTC
In the Linux kernel, the following vulnerability has been resolved:

regulator: core: use system_freezable_wq for init complete work

schedule_delayed_work() uses system_wq, which is non-freezable, allowing
regulator_init_complete_work to run concurrently with system suspend. This
work fires ~30s after boot to disable unused regulators via I2C. When it
races with PM suspend, the I2C adapter may already be suspended, triggering
a -ESHUTDOWN warning in __i2c_transfer():

  WARNING: ... at __i2c_transfer+0x36c/0x3c8
  Call trace:
   __i2c_transfer
   i2c_transfer
   regmap_i2c_write
   _regmap_update_bits
   regulator_disable_regmap
   _regulator_do_disable
   regulator_late_cleanup
   regulator_init_complete_work_function
   process_one_work

Switch to system_freezable_wq so the work is frozen before any device
is suspended, eliminating the race.


Note You need to log in before you can comment on or make changes to this bug.