Race condition in Linux kernel - CVE-2026-90285
Published: September 18, 2026
Vulnerability identifier: #VU151196
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90285
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to trigger concurrent flash access operations.
The vulnerability exists due to improper synchronization in qla2x00_sysfs_read_vpd() in the qla2xxx driver when reading VPD data through sysfs while concurrent optrom operations are occurring. A local user can read VPD data through sysfs during concurrent optrom operations to trigger concurrent flash access operations.
Affected software
Linux kernel
How to mitigate CVE-2026-90285
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/067504c00fe175864652764308922d99e199828f
- https://git.kernel.org/stable/c/0e4b5f8cad67eabf98da3f90b6443dcea5783ff3
- https://git.kernel.org/stable/c/5cbc49d5c4cd20c18041e86958103045216d2190
- https://git.kernel.org/stable/c/95e1ad3f19dfec09eb4f4273cf7079fd9b35cee6
- https://git.kernel.org/stable/c/9b6325fc58ab877ecb97fc5642a39e071c343315
- https://git.kernel.org/stable/c/abe224e7077ae5d47f1208430ede4d99ae310627
- https://git.kernel.org/stable/c/beaf45d9a10e7c1de86dcd1cbc8dc17f930444f7
- https://git.kernel.org/stable/c/ea79c01ef23c2ec3ace8a98ada517d56763814c2