Re: CVE-2026-90310: xen/xenbus: check otherend_id only after it has been initialized

["Jürgen Groß" <jgross@suse.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 1428 bytes --]

On 17.09.26 18:12, Greg Kroah-Hartman wrote:
> From: Greg Kroah-Hartman <gregkh@kernel.org>
> 
> Description
> ===========
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> xen/xenbus: check otherend_id only after it has been initialized
> 
> When device just got initialized (for example on module load), the
> otherend_id field is initialized only after
> xenbus_read_otherend_details() gets called. If xenstore watch triggers
> xenbus_dev_changed() before that, it might consider still zeroed
> otherend_id field (not matching actual xenstore content) as a sign of
> device state reset. It can happen because xenstore watch are handled in
> another thread (xenwatch), which can run in parallel to the initial
> device probe running at module load. In that case, it would call
> device_unregister(), which would deadlock against device probe from
> module init.
> 
> Fix this by considering dev->otherend_id change only after dev->otherend
> is set (which happen after otherend_id is initialized).
> 
> The Linux kernel CVE team has assigned CVE-2026-90310 to this issue.

I'd like to dispute this CVE.

This is nothing an unprivileged user has any influence on. The race can
happen only in Xen guests after a new PV-device has been added to it by the
host administrator.

This is just a regular bug with no security aspect, so please revoke this CVE.


Juergen

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]