CVE intelligence

CVE-2026-90130

Vulnerability intelligence

Published Sep 17, 2026Sources checked Nov 12, 2026

N/ACVSS not listedScore unavailable

What this means

Review the available evidence

CVE-2026-90130. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Microsoft Security Response Center guidance

Vendor revision: Oct 21, 2026

Release Notes

Vendor-listed releases

6.6.157.1-1

CISA KEVNot listedBased on the latest collected catalog

EPSS0.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-90130?

In the Linux kernel, the following vulnerability has been resolved:

vdpa_sim: fix cleanup after worker creation failure

vdpasim_create() leaves vdpasim->worker as an ERR_PTR when kthread_run_worker() fails. The error path then drops the device reference, which releases the partially initialized simulator.

vdpasim_free() unconditionally passes the worker pointer to kthread_destroy_worker(), so the ERR_PTR is dereferenced and can trigger a general protection fault.

Store the worker error, clear the pointer, and only clean up the worker when it was successfully initialized. Also make the release path tolerate partially initialized objects by guarding virtqueue and IOTLB cleanup, since the same release path can be reached from other initialization failures.

I found this bug myself, though the patch was written with AI assistance.

Source: NVD