CVE-2026-90338 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel systems, particularly those using PREEMPT_RT kernels, should assess exposure and prioritize patching affected versions. This includes verifying Linux kernel versions, applying patches, and monitoring system logs for potential issues related to this vulnerability. Operators, platform administrators, vulnerability management teams, and security teams may be impacted by this vulnerability and should review the supplied官方

Why it matters

This vulnerability allows an atomic-context printk on a PREEMPT_RT kernel with a clk-backed pl011 to trip a BUG, affecting Linux kernel systems.

• Verification of Linux kernel versions and potential patching to prevent BUG trips.
• Monitoring system logs for potential issues related to this vulnerability.
• Assessment of exposure for Arm32 and arm64 DT SoCs using PREEMPT_RT kernels.

Technical summary

The vulnerability is caused by a sleeping function call in the pl011_console_write_atomic function, which is not allowed in atomic context. This issue affects Arm32 and arm64 DT SoCs; arm64 SBSA/ACPI is not affected. The vulnerability allows an atomic-context printk on a PREEMPT_RT kernel with a clk-backed pl011 to trip a BUG. The issue is resolved by keeping the console clock enabled for atomic writes in the pl011_console_write_atomic function. Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this issue, particularly for systems using PREEMPT_RT kernels.

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this issue, particularly for systems using PREEMPT_RT kernels.

Recommended defensive actions

• Verify Linux kernel versions and check if they are affected by this vulnerability.
• Apply patches for affected Linux kernel versions, particularly for systems using PREEMPT_RT kernels.
• Monitor system logs for potential issues related to this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The issue was found and reproduced on PREEMPT_RT. The vulnerability is resolved by keeping the console clock enabled for atomic writes in the pl011_console_write_atomic function. This was verified through explicit evidence and defensive verification tasks. The CVE record was published on 2026-09-17T16:08:50.331Z and has not been modified since then. No additional information is available beyond the provided source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.