CVE-2026-90360: regulator: core: use system_freezable_wq for init complete work

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-17 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: regulator: core: use system_freezable_wq for init complete work schedule_delayed_work() uses system_wq, which is non-freezable, allowing regulator_init_complete_work to run concurrently with system suspend. This work fires ~30s after boot to disable unused regulators via I2C. When it races with PM suspend, the I2C adapter may already be suspended, triggering a -ESHUTDOWN warning in __i2c_transfer(): WARNING: ... at __i2c_transfer+0x36c/0x3c8 Call trace: __i2c_transfer i2c_transfer regmap_i2c_write _regmap_update_bits regulator_disable_regmap _regulator_do_disable regulator_late_cleanup regulator_init_complete_work_function process_one_work Switch to system_freezable_wq so the work is frozen before any device is suspended, eliminating the race.

Affected products

Linux kernel: from 4.9.195 before 4.9.207; from 4.14.147 before 4.14.160; from 4.19.77 before 4.20; from 5.2.19 before 5.3; from 5.3.4 before 5.4; 5.4 — fixed in 4.14.160, 4.20, 4.9.207, 5.3, 5.4, 7.3

How to fix

Upgrade to a fixed version: Linux kernel 4.14.160, 4.20, 4.9.207, 5.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-90360 or the next vulnerability affects your stack