7.7

CVE-2026-90150: linux

CVSS: 7.7v4.0HighReceived
AliasesUBUNTU-CVE-2026-90150DEBIAN-CVE-2026-90150
Published 17-09-2026Last modified 21-10-2026
Open JSON

Vulnerability summary

CVE-2026-90150 is a high (CVSS 7.7) vulnerability in linux. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.3% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.7/10
010
High · v4.0 (OSV · Ubuntu), selected by version preference
EPSS score
0.20%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 6
OPENSUSE-SU-2026:11893-1OPENSUSE-SU-2026:22091-1SUSE-SU-2026:24179-1SUSE-SU-2026:24184-1SUSE-SU-2026:24197-1SUSE-SU-2026:24235-1

Timeline

  1. 17-09-2026
    PublishedVulnerability first disclosed.
  2. 21-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: pnfs/blocklayout: Fix device leaks on parse failure bl_parse_concat() and bl_parse_stripe() allocate a child device array and then parse each child in turn. If parsing a child fails, the failed child is not counted in nr_children and the parent may be left with a children array that bl_free_device() will not release when nr_children is zero. Release the failed child and the already parsed children before returning the error. Also make bl_free_device() release the child array whenever the children pointer is set, so that partially initialised concat or stripe devices are cleaned up correctly. bl_parse_scsi() can also fail after assigning d->bdev_file and dropping the file reference. Clear the pointer after fput() so that an outer cleanup path does not put it again.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

0.20%

Chance of exploitation in the next 30 days

Percentile

9%

Versus all other CVEs

30-day change

0.00 pp

From 0.20% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.20%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.12.111-1 | < 7.2.6-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ 5c83746a0cf2831d4b59f5cf99ef5fbf138564e4, < 51d162dfb618f6cf3aa5e331c0305e27771ad884 | ≥ 5c83746a0cf2831d4b59f5cf99ef5fbf138564e4, < 8a2494964edac2a13e82441c2bf887548dc3be0b | ≥ 5c83746a0cf2831d4b59f5cf99ef5fbf138564e4, < 1e1c36b206c659cf94c6755a1d821ed1babd32bc | ≥ 5c83746a0cf2831d4b59f5cf99ef5fbf138564e4, < 23e4162405c456ce12c772d5882d306135e828ae | ≥ 5c83746a0cf2831d4b59f5cf99ef5fbf138564e4, < c056f817e4200fb18079d5052c273a22f191ff0a | 3.18

3 vendors · 172 products

References

9 links