Withdrawn: this CVE is not a vulnerability
The assigning CNA withdrew CVE-2026-90310 on 18 September 2026, and it carries the Rejected state at CVE.org and NVD. It must not be treated as a live finding. Its pre-withdrawal severity, score and exploitability are withheld below; the record itself is kept because withdrawals are reversible and because the reject reason is the correction worth publishing.
CVE-2026-90310
xen/xenbus: check otherend_id only after it has been initialized
Description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
INFO
Published Date :
Sept. 17, 2026, 5:17 p.m.
Last Modified :
Sept. 18, 2026, 12:17 p.m.
Remotely Exploit :
—
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-90310 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-90310 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Rejected by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 18, 2026
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 18, 2026
Action Type Old Value New Value Changed Description In the Linux kernel, the following vulnerability has been resolved: xen/xenbus: check otherend_id only after it has been initialized When device just got initialized (for example on module load), the otherend_id field is initialized only after xenbus_read_otherend_details() gets called. If xenstore watch triggers xenbus_dev_changed() before that, it might consider still zeroed otherend_id field (not matching actual xenstore content) as a sign of device state reset. It can happen because xenstore watch are handled in another thread (xenwatch), which can run in parallel to the initial device probe running at module load. In that case, it would call device_unregister(), which would deadlock against device probe from module init. Fix this by considering dev->otherend_id change only after dev->otherend is set (which happen after otherend_id is initialized). Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Added Affected Affected value removed. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/90xxx/CVE-2026-90310.json">CVE-2026-90310</a> Removed Reference kernel.org: https://git.kernel.org/stable/c/36fb592af353c55832e2cafe3fcfc3291be05f19 Removed Reference kernel.org: https://git.kernel.org/stable/c/c76cbf348c7df077f93fa99a1225a527ce64cfa1 -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 17, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: xen/xenbus: check otherend_id only after it has been initialized When device just got initialized (for example on module load), the otherend_id field is initialized only after xenbus_read_otherend_details() gets called. If xenstore watch triggers xenbus_dev_changed() before that, it might consider still zeroed otherend_id field (not matching actual xenstore content) as a sign of device state reset. It can happen because xenstore watch are handled in another thread (xenwatch), which can run in parallel to the initial device probe running at module load. In that case, it would call device_unregister(), which would deadlock against device probe from module init. Fix this by considering dev->otherend_id change only after dev->otherend is set (which happen after otherend_id is initialized). Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/90xxx/CVE-2026-90310.json">CVE-2026-90310</a> Added Reference https://git.kernel.org/stable/c/36fb592af353c55832e2cafe3fcfc3291be05f19 Added Reference https://git.kernel.org/stable/c/c76cbf348c7df077f93fa99a1225a527ce64cfa1