CVE-2026-90129

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

virtio_balloon: quiesce balloon work before device shutdown

Commit 8bd2fa086a04 ("virtio: break and reset virtio devices on

device_shutdown()") added a generic virtio bus .shutdown handler that

breaks and resets every virtio device during device_shutdown(), i.e. on

reboot and kexec.

virtio_balloon provides no .shutdown of its own, so that generic path

runs while the balloon's asynchronous work is still armed. Once the

device has been broken, virtqueue_add_inbuf() in

virtballoon_free_page_report() returns -EIO and trips its

WARN_ON_ONCE(). On a kernel booted with panic_on_warn that turns an

ordinary reboot, for example a kexec based upgrade, into a fatal panic

in the middle of device_shutdown(), so the machine never reaches the

new kernel.

Relaxing that single WARN_ON_ONCE() would only hide the symptom: the

inflate/deflate and OOM paths do not warn, they call

wait_event(vb->acked, ...) and would instead block foreve

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References