Executive brief
The Linux kernel's qla2xxx SCSI driver contains a race condition in its VPD (Vital Product Data) flash read path. A redundant flash read operation was being performed without proper mutex protection, allowing concurrent firmware operations to interfere with flash access. This could lead to inconsistent or corrupted VPD data reads on affected systems.
Technical details
The vulnerability is a race condition in the qla2x00_sysfs_read_vpd() function in the qla2xxx SCSI driver. The function calls ha->isp_ops->read_optrom() twice: once with optrom_mutex held, and a second time after releasing the mutex. The unprotected second read exposes flash memory access to concurrent optrom operations, creating a data race. The fix removes the redundant duplicate read operation. The vulnerability affects systems using the qla2xxx driver for Fibre Channel HBA devices and requires local access via the sysfs interface to trigger.
Affected products
- Linux Linux kernel Linux 5.x through 7.x (qla2xxx driver present in kernel versions containing commit 5fa8774c7f38 and later)
Timeline
- 2026-09-17: disclosed: Reported as CVE-2026-90285
- 2026-07-23: patched: Upstream commit 5cbc49d5c4cd20c18041e86958103045216d2190 authored by Manish Rangankar
- 2026-09-14: other: Stable kernel patches applied via Greg Kroah-Hartman