Executive brief
The Linux kernel's ENE card reader driver (ene_ub6250) contains a race condition between USB device initialization and background scanning work. During device probing, the code queries the card type without proper synchronization, which can conflict with concurrent scan operations. While this causes kernel warnings and may disrupt device detection, it does not result in data exposure or system compromise in typical deployments.
Technical details
The vulnerability is a missing synchronization primitive (mutex lock) in the ENE card-type probe path. The ene_ub6250_probe() function calls ene_get_card_type(), which uses us->current_urb to send USB requests, while simultaneously usb_stor_probe2() schedules delayed scan work via usb_stor_Bulk_max_lun() that also accesses the same shared resource. The scan work properly serializes access with us->dev_mutex, but the probe path does not, allowing concurrent access to us->current_urb. When both code paths execute concurrently, usb_submit_urb() logs warnings that the URB is already active. The fix adds mutex_lock(&us->dev_mutex) around the ene_get_card_type() call to match the locking pattern used elsewhere. A patch has been committed to the Linux kernel stable tree.
Affected products
- Linux Linux kernel multiple stable versions (2.6.11 through 7.2, rolling-lts, rolling-stable)
Timeline
- 2026-09-16: disclosed: CVE published
- 2026-09-01: patched: Upstream fix committed (445fc368c6bc73eff0aeb3818cf5f355facfbb16)
- 2026-08-21: other: Original fix authored and reported via syzbot