# CVE-2026-90342: linux: In the Linux kernel, the following vulnerability has been resolved:  bpf: Fix mmap_lock deadlock on arena lock failur...

CVE-2026-90342 is fixed in linux on 1 platform by DEBIAN-CVE-2026-90342 (version 7.2.6-1), released September 23, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-90342
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0020
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 17, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  bpf: Fix mmap_lock deadlock on arena lock failure  Reported by the Sashiko AI review.  arena_vm_fault() returns VM_FAULT_RETRY when it can't take arena->spinlock, but it never took mmap_lock. The fault path assumes a VM_FAULT_RETRY handler already dropped mmap_lock and re-takes it on the retry, so mmap_lock gets taken twice and can deadlock:  	do_user_addr_fault() 	{ 		fault = handle_mm_fault(...);   // calls arena_vm_fault() 		if (fault & VM_FAULT_RETRY) 			goto retry;   // re-locks mmap_lock 		mmap_read_unlock(mm); 	}  Return VM_FAULT_SIGBUS instead, for two reasons:  1. We could keep VM_FAULT_RETRY, but then we'd have to drop the fault    lock first and cap the retry ourselves, the way __folio_lock_or_retry()    does.  2. A failed raw_res_spin_lock_irqsave() already means a possible deadlock    was detected, so retrying just hits the same lock again.  So returning VM_FAULT_RETRY here is overkill.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.6-1 | [DEBIAN-CVE-2026-90342](https://patchblox.com/security/data/fix/linux/debian-cve-2026-90342.md) | Sep 23, 2026 |

---

Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.