CVE-2026-90285scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path qla2x00_sysfs_read_vpd() called ha->isp_ops->read_optrom() a second time after releasing optrom_mutex. The repeated read is redundant and, unlike the first, runs without optrom_mutex held, exposing flash access to concurrent optrom operations. Drop the duplicate call.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5fa8774c7f38c79f38b672c1a0db0c049da477d6 before ea79c01ef23c2ec3ace8a98ada517d56763814c2; from 5fa8774c7f38c79f38b672c1a0db0c049da477d6 before beaf45d9a10e7c1de86dcd1cbc8dc17f930444f7; from 5fa8774c7f38c79f38b672c1a0db0c049da477d6 before abe224e7077ae5d47f1208430ede4d99ae310627; from 5fa8774c7f38c79f38b672c1a0db0c049da477d6 before 9b6325fc58ab877ecb97fc5642a39e071c343315; from 5fa8774c7f38c79f38b672c1a0db0c049da477d6 before 95e1ad3f19dfec09eb4f4273cf7079fd9b35cee6; from 5fa8774c7f38c79f38b672c1a0db0c049da477d6 before 067504c00fe175864652764308922d99e199828f; 5fa8774c7f38c79f38b672c1a0db0c049da477d6 builds before 0e4b5f8cad67eabf98da3f90b6443dcea5783ff3; 5fa8774c7f38c79f38b672c1a0db0c049da477d6 builds before 5cbc49d5c4cd20c18041e86958103045216d2190 | CNA record |
References
- https://git.kernel.org/stable/c/ea79c01ef23c2ec3ace8a98ada517d56763814c2
- https://git.kernel.org/stable/c/beaf45d9a10e7c1de86dcd1cbc8dc17f930444f7
- https://git.kernel.org/stable/c/abe224e7077ae5d47f1208430ede4d99ae310627
- https://git.kernel.org/stable/c/9b6325fc58ab877ecb97fc5642a39e071c343315
- https://git.kernel.org/stable/c/95e1ad3f19dfec09eb4f4273cf7079fd9b35cee6
- https://git.kernel.org/stable/c/067504c00fe175864652764308922d99e199828f
- https://git.kernel.org/stable/c/0e4b5f8cad67eabf98da3f90b6443dcea5783ff3
- https://git.kernel.org/stable/c/5cbc49d5c4cd20c18041e86958103045216d2190
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.