Cloudanix VulnDB

CVE-2026-90404

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A cleanup mistake in Linux device handling can cause crashes or instability when the system panics after certain hardware drivers are removed.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
High
Impact
Other
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

The flaw leaves a panic notifier registered after cros_ec_debugfs teardown, allowing a subsequent panic to invoke the notifier and queue work that dereferences already-freed memory, resulting in a use-after-free.

Why it matters to the business

Unexpected kernel instability or crashes on systems using the Chrome EC debugfs driver, raising operational risk during panic events and complicating recovery in production fleets.

How an attack unfolds

An attacker with local access removes or unloads the cros_ec_debugfs module, then induces a kernel panic; the still-registered notifier fires and accesses released data structures.

How to fix it

Apply the upstream fix that unregisters the panic notifier before tearing down debugfs and console state; rebuild and deploy the corrected kernel.

How to confirm the fix worked

Inspect the cros_ec_debugfs remove path to confirm notifier unregistration occurs before state teardown; boot the patched kernel and verify no use-after-free warnings under panic injection tests.

Typical attack path

  1. Obtain local privileges sufficient to trigger module removal or device unbind
  2. Force a kernel panic via crafted input or workload
  3. Panic notifier callback executes on the removed instance
  4. Work is queued against freed memory

How to detect it

Search kernel logs and panic traces for references to cros_ec_debugfs notifier callbacks after module unload events; correlate with use-after-free warnings from KASAN or similar detectors.

What your security team should do

  • Prioritize kernel updates containing the notifier-unregister change on all Chrome OS and embedded Linux devices
  • Monitor upstream stable branches for the backport
  • Review static-analysis findings for similar notifier-registration patterns in other drivers

The record

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_debugfs: Unregister panic notifier cros_ec_debugfs_probe() registers notifier_panic with the EC panic notifier chain. The remove path tears down debugfs and the console log, but leaves the notifier registered. A later panic notification can call back into the removed instance and queue work that accesses released data. Unregister the panic notifier before tearing down the debugfs and console log state. This issue was found by a static analysis tool.

Affected packages

Ecosystem Package Introduced Fixed