In the Linux kernel, the following vulnerability has been resolved: regulator: core: use system_freezable_wq for init complete work schedule_delayed_work() uses system_wq, which is non-freezable, allowing regulator_init_complete_work to run concurrently with system suspend. This work fires ~30s after boot to disable unused regulators via I2C. When it races with PM suspend, the I2C adapter may already be suspended, triggering a -ESHUTDOWN warning in __i2c_transfer(): WARNING: ... at __i2c_transfer+0x36c/0x3c8 Call trace: __i2c_transfer i2c_transfer regmap_i2c_write _regmap_update_bits regulator_disable_regmap _regulator_do_disable regulator_late_cleanup regulator_init_complete_work_function process_one_work Switch to system_freezable_wq so the work is frozen before any device is suspended, eliminating the race.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - regulator: core: use system_freezable_wq for init complete work schedule_delayed_work() uses system_wq,     which is non-freezable, allowing regulator_init_complete_work to run concurrently with system suspend.
    This work fires ~30s after boot to disable unused regulators via I2C. When it races with PM suspend, the     I2C adapter may already be suspended, triggering a -ESHUTDOWN warning in __i2c_transfer(): WARNING: ... at
    __i2c_transfer+0x36c/0x3c8 Call trace: __i2c_transfer i2c_transfer regmap_i2c_write _regmap_update_bits     regulator_disable_regmap _regulator_do_disable regulator_late_cleanup     regulator_init_complete_work_function process_one_work Switch to system_freezable_wq so the work is frozen     before any device is suspended, eliminating the race. (CVE-2026-90360)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
366919	Debian dla-4841 : ata-modules-6.1.0-53-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
366741	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-135)	Nessus	Amazon Linux Local Security Checks	Local	critical
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
347470	Linux Distros Unpatched Vulnerability : CVE-2026-90360	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-90360

medium

Tenable Plugins

high

critical

high

high

high

medium