vdpa_sim: fix cleanup after worker creation failure (CVE-2026-90130) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-90130

vdpa_sim: fix cleanup after worker creation failure

Answer in brief

CVE-2026-90130 records a Unknown severity vulnerability in vdpa_sim: fix cleanup after worker creation failure. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 17, 2026Updated Sep 17, 2026Source checked Sep 17, 2026First seen by HOL Sep 17, 2026Material review Sep 17, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=76acfa7bc54f1e3b9dde396e0a3534493419fd6f <feafa109f031ed111f7f968e447c13985db498e0 \|\| >=76acfa7bc54f1e3b9dde396e0a3534493419fd6f <05ddc94afb69e36df59e88cfa9e5c7bf9d10cfd0 \|\| >=76acfa7bc54f1e3b9dde396e0a3534493419fd6f <68b726b3a01fb02a68843781b17d05ef3d759987 \|\| >=76acfa7bc54f1e3b9dde396e0a3534493419fd6f <ca6f3fa599cb764518df595368b743f856fdb516 \|\| >=76acfa7bc54f1e3b9dde396e0a3534493419fd6f <bd670e5dfd2b01fd9692f61fa1456434c54026a4	feafa109f031ed111f7f968e447c13985db498e0, 05ddc94afb69e36df59e88cfa9e5c7bf9d10cfd0, 68b726b3a01fb02a68843781b17d05ef3d759987, ca6f3fa599cb764518df595368b743f856fdb516, bd670e5dfd2b01fd9692f61fa1456434c54026a4
Linux/Linuxgeneric	6.4	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to feafa109f031ed111f7f968e447c13985db498e0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 17, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: vdpa_sim: fix cleanup after worker creation failure vdpasim_create() leaves vdpasim->worker as an ERR_PTR when kthread_run_worker() fails. The error path then drops the device reference, which releases the partially initialized simulator. vdpasim_free() unconditionally passes the worker pointer to kthread_destroy_worker(), so the ERR_PTR is dereferenced and can trigger a general protection fault. Store the worker error, clear the pointer, and only clean up the worker when it was successfully initialized. Also make the release path tolerate partially initialized objects by guarding virtqueue and IOTLB cleanup, since the same release path can be reached from other initialization failures. I found this bug myself, though the patch was written with AI assistance.

Quoted source text, attributed separately from HOL analysis.