Improper handling of exceptional conditions in Linux kernel - CVE-2026-90306
Published: September 19, 2026
Vulnerability identifier: #VU151442
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90306
CWE-ID: CWE-755
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to prevent normal handling of userspace breakpoints.
The vulnerability exists due to incorrect handling of exceptional conditions in the ARM hardware breakpoint handler when processing userspace breakpoints of type 0x03 (ARM_ENTRY_CFI_BREAKPOINT). A local user can issue a breakpoint of this type from userspace to prevent normal handling of userspace breakpoints.
The behavior also occurs when kernel CFI instrumentation is disabled.
Affected software
Linux kernel
How to mitigate CVE-2026-90306
Install security update from vendor's repository.