CVE-2026-90421

What it actually does

Use-after-free in PCI dynamic ID handling: remove_id_store() can free a dynid node while pci_match_device() still holds a reference without the dynids.lock held, allowing concurrent probe to dereference freed memory.

Why it matters to the business

Linux systems may experience kernel crashes or memory corruption during hot-plug or dynamic device ID operations, causing downtime on servers, embedded devices, and cloud instances.

How an attack unfolds

An attacker with local access triggers concurrent calls to remove_id_store() and a PCI probe path so that pci_match_device() reads a freed dynid structure, leading to a use-after-free that may be leveraged for denial of service or further kernel exploitation.

How to fix it

Apply the upstream kernel commit that copies the dynid under lock in pci_match_device() and ensures the id parameter lifetime is limited to the probe window; rebuild and reboot to the patched kernel.

How to confirm the fix worked

Confirm the fix is present by inspecting the pci_match_device() implementation for the dynid copy under dynids.lock; test by exercising concurrent add/remove/probe operations without triggering UAF.

Typical attack path

1. Obtain local access on a Linux system exposing dynamic PCI ID interfaces
2. Race remove_id_store() with a concurrent device probe that calls pci_match_device()
3. Trigger use-after-free by dereferencing the freed dynid node
4. Escalate or crash depending on exploitation of the freed memory

How to detect it

Search kernel logs for PCI dynid-related slab use-after-free warnings, oops traces mentioning pci_match_device or remove_id_store, and any concurrent sysfs writes to new_id/remove_id during device probe events.

What your security team should do

• Prioritize patching production kernels that expose dynamic PCI ID sysfs interfaces
• Monitor for kernel oops or slab corruption logs related to PCI dynids
• Restrict unprivileged access to PCI ID modification sysfs entries until patched