CVE-2026-90285 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
qla2x00_sysfs_read_vpd() called ha->isp_ops->read_optrom() a second time after releasing optrom_mutex. The repeated read is redundant and, unlike the first, runs without optrom_mutex held, exposing flash access to concurrent optrom operations. Drop the duplicate call.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's SCSI subsystem contains a specific implementation flaw within the qla2xxx driver that introduces a race condition during Virtual Product Identification (VPD) data retrieval via sysfs interfaces. The vulnerability resides in the function qla2x00_sysfs_read_vpd, which is responsible for reading optical ROM contents from QLogic Fibre Channel host bus adapters. Under normal operation, access to hardware resources such as flash memory requires strict synchronization to prevent concurrent modifications or reads that could lead to data corruption or undefined behavior. The driver utilizes a mutex named optrom_mutex to serialize these operations, ensuring that only one thread can interact with the optical ROM at any given time. However, the code logic contains an error where the function invokes ha->isp_ops->read_optrom() twice in succession. Crucially, while the first invocation is correctly protected by holding the optrom_mutex, the second invocation occurs after this mutex has already been released.
This architectural oversight creates a window of vulnerability where flash access operations are executed without proper synchronization primitives. By performing a redundant read operation outside the critical section defined by the mutex, the driver exposes the underlying hardware interface to concurrent optrom operations initiated by other kernel threads or processes. This lack of mutual exclusion allows multiple execution paths to potentially access and modify shared state within the optical ROM subsystem simultaneously. In systems with high concurrency or under heavy I/O load, this race condition can lead to inconsistent data states, potential kernel panics due to invalid memory accesses during flash operations, or subtle data corruption that may not be immediately apparent but could compromise system stability over time.
From a security and reliability perspective, this flaw aligns with CWE-362, which describes concurrent execution using shared resources with improper synchronization. The absence of proper locking mechanisms for the second read operation violates fundamental principles of safe concurrency in kernel-space code. Furthermore, because sysfs interfaces are often accessible to user-space applications depending on system configuration and permissions, an attacker or a buggy application could potentially trigger this path repeatedly to exacerbate the race condition. This increases the attack surface for denial-of-service scenarios where repeated triggering might destabilize the SCSI subsystem or cause the host adapter driver to crash, leading to service interruption. The vulnerability does not directly facilitate privilege escalation but significantly impacts system availability and integrity by undermining the reliability of hardware abstraction layers.
To mitigate this risk, the recommended action is to remove the redundant call to read_optrom() that occurs after the mutex release. By eliminating this duplicate operation, the code path becomes both more efficient and safer, as it no longer attempts unsynchronized access to shared flash resources. This fix ensures that all interactions with the optical ROM are properly serialized through the existing optrom_mutex mechanism. System administrators should apply kernel updates or driver patches provided by their distribution vendors that include this correction. Until patched, monitoring system logs for SCSI-related errors or unexpected reboots may help identify systems potentially affected by race conditions in high-concurrency environments. Maintaining up-to-date drivers and kernels is essential to preserve the integrity of storage subsystems and prevent potential stability issues arising from improper synchronization primitives.