Cloudanix VulnDB

CVE-2026-90285

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A mistake in the Linux kernel code that reads storage device details could let programs on the same computer step on each other and cause hardware problems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A redundant call to read_optrom() in qla2x00_sysfs_read_vpd() executes after optrom_mutex release, allowing concurrent unprotected flash access on QLogic SCSI HBAs and introducing a race condition.

Why it matters to the business

Local interference with storage adapter flash operations may cause device state corruption or inconsistent behavior on affected Linux systems using qla2xxx drivers.

How an attack unfolds

An attacker with local system access triggers the sysfs VPD read path while another optrom operation is in progress, exploiting the missing mutex on the duplicate read call.

How to fix it

Apply the upstream kernel commit that removes the duplicate read_optrom call; rebuild and deploy the fixed kernel on all affected hosts.

How to confirm the fix worked

Inspect the qla2x00_sysfs_read_vpd function in the running kernel source to confirm the second read_optrom call has been removed and the mutex remains held throughout.

Typical attack path

  1. Obtain local shell or process execution on a Linux host with qla2xxx hardware
  2. Access the sysfs VPD read interface for the adapter
  3. Trigger or time concurrent optrom operations to hit the unprotected read
  4. Observe or manipulate resulting flash access race

How to detect it

Search kernel logs and audit trails for concurrent qla2xxx optrom or sysfs VPD activity; examine source history to confirm exposure before the fix.

What your security team should do

  • Update Linux kernels containing qla2xxx to the fixed version as soon as available
  • Limit unprivileged local access on systems exposing qla2xxx sysfs interfaces
  • Review kernel logs for optrom or VPD-related anomalies during patching windows

The record

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00_sysfs_read_vpd() called ha->isp_ops->read_optrom() a second time after releasing optrom_mutex. The repeated read is redundant and, unlike the first, runs without optrom_mutex held, exposing flash access to concurrent optrom operations. Drop the duplicate call.

Affected packages

Ecosystem Package Introduced Fixed