Race condition in Linux kernel - CVE-2026-90031
Published: September 16, 2026
Vulnerability identifier: #VU150251
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90031
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker with physical access to trigger a warning that a URB is already active.
The vulnerability exists due to a race condition in the ENE UB6250 USB-storage driver when delayed scan work runs concurrently with card-type probing. An attacker with physical access can cause concurrent access to us->current_urb during device probing to trigger a warning that a URB is already active.
Affected software
Linux kernel
How to mitigate CVE-2026-90031
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/1c67f2ba9c5f7c5ab3670671c0d51c6504bcaf74
- https://git.kernel.org/stable/c/445fc368c6bc73eff0aeb3818cf5f355facfbb16
- https://git.kernel.org/stable/c/5082546702c32a2700894d2c0ace784e038ef6a3
- https://git.kernel.org/stable/c/8936d95dd04d34db96d4d1e3899eee52605bbedc
- https://git.kernel.org/stable/c/9481bc04a8c351ed883a7f0e10939bbe9120ead7
- https://git.kernel.org/stable/c/996c319b8bd5ada1f62daae0d331d0b23e0f2117
- https://git.kernel.org/stable/c/9c261a83131e241d67cb73ab578d0265bc19cfb5
- https://git.kernel.org/stable/c/9cd335f4f41e84d1ab88d80150ffee8dee9650d7