{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler  qcom_cpucp_mbox_irq_fn() calls mbox_chan_received_data() while holding chan-\u003elock. Under PREEMPT_RT, spin_lock_irqsave() is converted to an rt_spinlock (rtmutex-based), which tracks ownership and can sleep.  The callback chain triggered by mbox_chan_received_data() eventually reaches mailbox_clear_channel() -\u003e mbox_send_message() -\u003e add_to_rbuf(), which attempts to re-acquire the same chan-\u003elock. Since rtmutex detects the re-entrant lock attempt by the same owner, the thread blocks waiting for a lock it already holds, causing a permanent deadlock.  This deadlock manifests as 'irq/N-apss_cpucp_mbox' stuck in D state with the following call trace:   rt_spin_lock -\u003e mbox_send_message -\u003e mailbox_clear_channel -\u003e   scmi_rx_callback -\u003e mbox_chan_received_data [\u003c- held chan-\u003elock here]  Fix by saving chan-\u003ecl locally and clearing the HW interrupt register inside the lock, then invoking mbox_chan_received_data() after releasing the lock. This preserves the mutual exclusion for chan-\u003ecl access while avoiding the lock re-entrancy that causes the PREEMPT_RT deadlock.",
  "id": "DEBIAN-CVE-2026-90193",
  "modified": "2026-09-18T04:47:29.572950171Z",
  "published": "2026-09-17T17:17:14.030Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-90193"
    }
  ],
  "upstream": [
    "CVE-2026-90193"
  ]
}