Not yet scoredPublished Sep 17, 2026

CVE-2026-90360regulator: core: use system_freezable_wq for init complete work

Updated under an hour ago (Oct 27, 2026, 6:50 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: regulator: core: use system_freezable_wq for init complete work schedule_delayed_work() uses system_wq, which is non-freezable, allowing regulator_init_complete_work to run concurrently with system suspend. This work fires ~30s after boot to disable unused regulators via I2C. When it races with PM suspend, the I2C adapter may already be suspended, triggering a -ESHUTDOWN warning in __i2c_transfer(): WARNING: ... at __i2c_transfer+0x36c/0x3c8 Call trace: __i2c_transfer i2c_transfer regmap_i2c_write _regmap_update_bits regulator_disable_regmap _regulator_do_disable regulator_late_cleanup regulator_init_complete_work_function process_one_work Switch to system_freezable_wq so the work is frozen before any device is suspended, eliminating the race.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	8b8c8d69b1a31004517d4c71a490f47bdf3405a2 builds before 8a2ae3ab348cce44120667277c2198f10cc348b1; from d7ce17fba6c8e316ca9a554a87edddce6f862435 before 350a0cba90e1bd40b1fe5b396923d2f3a61d1056; 55576cf1853798e86f620766e23b604c9224c19c builds before 2cebc00340a585adeffe321bc41f1937eb79a4dc; 55576cf1853798e86f620766e23b604c9224c19c builds before 9cf65270c1c1717c84dcfacd58a782c1186b0cbf; from 55576cf1853798e86f620766e23b604c9224c19c before dc8570a5b830190bf0b57017c35aef97cd6ad7d9; 55576cf1853798e86f620766e23b604c9224c19c builds before 6d0a2c5e210f2fba099129e6183ef81316a6ae48; 55576cf1853798e86f620766e23b604c9224c19c builds before 0d23d658d79925076026fff62a49b8c94e0e8922; 55576cf1853798e86f620766e23b604c9224c19c builds before 0b950aa7ec95e120b2bde745ca9a7ed3ce49d528; and 10 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/8a2ae3ab348cce44120667277c2198f10cc348b1
https://git.kernel.org/stable/c/350a0cba90e1bd40b1fe5b396923d2f3a61d1056
https://git.kernel.org/stable/c/2cebc00340a585adeffe321bc41f1937eb79a4dc
https://git.kernel.org/stable/c/9cf65270c1c1717c84dcfacd58a782c1186b0cbf
https://git.kernel.org/stable/c/dc8570a5b830190bf0b57017c35aef97cd6ad7d9
https://git.kernel.org/stable/c/6d0a2c5e210f2fba099129e6183ef81316a6ae48
https://git.kernel.org/stable/c/0d23d658d79925076026fff62a49b8c94e0e8922
https://git.kernel.org/stable/c/0b950aa7ec95e120b2bde745ca9a7ed3ce49d528
https://git.kernel.org/stable/c/29dc2e24f6adb36dcb884acf455644c397a67471
https://git.kernel.org/stable/c/03eab318cedd6ae34ecd34533cd986edf5237164

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.