Re: CVE-2026-90310: xen/xenbus: check otherend_id only after it has been initialized

[Greg KH]

On Thu, Sep 17, 2026 at 10:04:39PM +0200, Jürgen Groß wrote:
> On 17.09.26 18:12, Greg Kroah-Hartman wrote:
> > From: Greg Kroah-Hartman <gregkh@xxxxxxxxxx>
> > 
> > Description
> > ===========
> > 
> > In the Linux kernel, the following vulnerability has been resolved:
> > 
> > xen/xenbus: check otherend_id only after it has been initialized
> > 
> > When device just got initialized (for example on module load), the
> > otherend_id field is initialized only after
> > xenbus_read_otherend_details() gets called. If xenstore watch triggers
> > xenbus_dev_changed() before that, it might consider still zeroed
> > otherend_id field (not matching actual xenstore content) as a sign of
> > device state reset. It can happen because xenstore watch are handled in
> > another thread (xenwatch), which can run in parallel to the initial
> > device probe running at module load. In that case, it would call
> > device_unregister(), which would deadlock against device probe from
> > module init.
> > 
> > Fix this by considering dev->otherend_id change only after dev->otherend
> > is set (which happen after otherend_id is initialized).
> > 
> > The Linux kernel CVE team has assigned CVE-2026-90310 to this issue.
> 
> I'd like to dispute this CVE.
> 
> This is nothing an unprivileged user has any influence on. The race can
> happen only in Xen guests after a new PV-device has been added to it by the
> host administrator.
> 
> This is just a regular bug with no security aspect, so please revoke this CVE.

Thanks for the review, now rejected!

greg k-h