Executive brief
The Linux kernel's qla2xxx SCSI driver is vulnerable to a race condition in its flash version reading code. When a system administrator triggers a sysfs reset operation to update firmware cache versions, the driver accesses hardware flash memory without proper locking. This can cause corrupted reads if another process concurrently performs VPD or firmware updates, potentially leading to incorrect firmware version information or device state corruption.
Technical details
This is a race condition vulnerability (CWE-362) in the qla2xxx SCSI driver's reset handler. The vulnerable code path is the "update cache versions without reset" sysfs operation (0x20261), which calls get_flash_version() to read hardware flash registers without holding the ha->optrom_mutex lock. The VPD (Vital Product Data) update path correctly serializes the same function call under optrom_mutex. An attacker or unprivileged user with access to sysfs reset operations can trigger concurrent flash accesses that interleave with legitimate VPD or optrom flash operations, corrupting the flash register reads. The fix adds mutex_lock/mutex_unlock calls around the get_flash_version() invocation to match the VPD path's locking pattern. Patches are available in the Linux kernel stable trees.
Affected products
- Linux Linux kernel multiple versions (see stable tree backports)
Timeline
- 2026-09-16: disclosed
- 2026-09-14: patched: Commit 31bf2714abbb0aa5a8a03d15038f8920e1c74b21 in stable kernels