Re: CVE-2026-90310: xen/xenbus: check otherend_id only after it has been initialized

Re: CVE-2026-90310: xen/xenbus: check otherend_id only after it has been initialized

[Jürgen Groß]

[-- Attachment #1.1.1: Type: text/plain, Size: 1428 bytes --]

On 17.09.26 18:12, Greg Kroah-Hartman wrote:
> From: Greg Kroah-Hartman <gregkh@kernel.org>
> 
> Description
> ===========
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> xen/xenbus: check otherend_id only after it has been initialized
> 
> When device just got initialized (for example on module load), the
> otherend_id field is initialized only after
> xenbus_read_otherend_details() gets called. If xenstore watch triggers
> xenbus_dev_changed() before that, it might consider still zeroed
> otherend_id field (not matching actual xenstore content) as a sign of
> device state reset. It can happen because xenstore watch are handled in
> another thread (xenwatch), which can run in parallel to the initial
> device probe running at module load. In that case, it would call
> device_unregister(), which would deadlock against device probe from
> module init.
> 
> Fix this by considering dev->otherend_id change only after dev->otherend
> is set (which happen after otherend_id is initialized).
> 
> The Linux kernel CVE team has assigned CVE-2026-90310 to this issue.

I'd like to dispute this CVE.

This is nothing an unprivileged user has any influence on. The race can
happen only in Xen guests after a new PV-device has been added to it by the
host administrator.

This is just a regular bug with no security aspect, so please revoke this CVE.


Juergen

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]

Re: CVE-2026-90310: xen/xenbus: check otherend_id only after it has been initialized

[Greg KH]

On Thu, Sep 17, 2026 at 10:04:39PM +0200, Jürgen Groß wrote:
> On 17.09.26 18:12, Greg Kroah-Hartman wrote:
> > From: Greg Kroah-Hartman <gregkh@kernel.org>
> > 
> > Description
> > ===========
> > 
> > In the Linux kernel, the following vulnerability has been resolved:
> > 
> > xen/xenbus: check otherend_id only after it has been initialized
> > 
> > When device just got initialized (for example on module load), the
> > otherend_id field is initialized only after
> > xenbus_read_otherend_details() gets called. If xenstore watch triggers
> > xenbus_dev_changed() before that, it might consider still zeroed
> > otherend_id field (not matching actual xenstore content) as a sign of
> > device state reset. It can happen because xenstore watch are handled in
> > another thread (xenwatch), which can run in parallel to the initial
> > device probe running at module load. In that case, it would call
> > device_unregister(), which would deadlock against device probe from
> > module init.
> > 
> > Fix this by considering dev->otherend_id change only after dev->otherend
> > is set (which happen after otherend_id is initialized).
> > 
> > The Linux kernel CVE team has assigned CVE-2026-90310 to this issue.
> 
> I'd like to dispute this CVE.
> 
> This is nothing an unprivileged user has any influence on. The race can
> happen only in Xen guests after a new PV-device has been added to it by the
> host administrator.
> 
> This is just a regular bug with no security aspect, so please revoke this CVE.

Thanks for the review, now rejected!

greg k-h