{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "8bd2fa086a04886798b505f28db4002525895203"
            },
            {
              "fixed": "6dd28e32f4d81a0d57c732b9900de24184e60a7d"
            },
            {
              "fixed": "bdef50a8226fc04899ef6815dd08a002247d47d5"
            },
            {
              "fixed": "7e17eef04600c399c7e0f5ce765da5cf9d40d8e1"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "aee42f3d57bfa37b2716df4584edeecf63b9df4c"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.14.9"
            },
            {
              "fixed": "6.15"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.15.0"
            },
            {
              "fixed": "6.18.52"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90129.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio_balloon: quiesce balloon work before device shutdown\n\nCommit 8bd2fa086a04 (\"virtio: break and reset virtio devices on\ndevice_shutdown()\") added a generic virtio bus .shutdown handler that\nbreaks and resets every virtio device during device_shutdown(), i.e. on\nreboot and kexec.\n\nvirtio_balloon provides no .shutdown of its own, so that generic path\nruns while the balloon's asynchronous work is still armed. Once the\ndevice has been broken, virtqueue_add_inbuf() in\nvirtballoon_free_page_report() returns -EIO and trips its\nWARN_ON_ONCE(). On a kernel booted with panic_on_warn that turns an\nordinary reboot, for example a kexec based upgrade, into a fatal panic\nin the middle of device_shutdown(), so the machine never reaches the\nnew kernel.\n\nRelaxing that single WARN_ON_ONCE() would only hide the symptom: the\ninflate/deflate and OOM paths do not warn, they call\nwait_event(vb-\u003eacked, ...) and would instead block forever on a broken\nqueue that can no longer complete. The device has to be quiesced, not\njust kept quiet.\n\nAdd a .shutdown handler that quiesces the balloon via the shared\nvirtballoon_quiesce() helper while the device is still alive, and only\nthen breaks and resets it via virtio_device_shutdown(). Unlike\nvirtballoon_remove() the balloon workqueue is not destroyed, as shutdown\ndoes not free the device and cancel_work_sync() together with stop_update\nalready prevent any further work from being queued.",
  "id": "CVE-2026-90129",
  "modified": "2026-09-19T03:30:16.773202046Z",
  "published": "2026-09-17T16:06:30.537Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6dd28e32f4d81a0d57c732b9900de24184e60a7d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7e17eef04600c399c7e0f5ce765da5cf9d40d8e1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bdef50a8226fc04899ef6815dd08a002247d47d5"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90129.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90129"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "virtio_balloon: quiesce balloon work before device shutdown"
}