CVE-2026-90285

scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 19, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path

qla2x00_sysfs_read_vpd() called ha->isp_ops->read_optrom() a second time after releasing optrom_mutex. The repeated read is redundant and, unlike the first, runs without optrom_mutex held, exposing flash access to concurrent optrom operations. Drop the duplicate call.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before ea79c01ef23c2ec3ace8a98ada517d56763814c2Affected 5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before beaf45d9a10e7c1de86dcd1cbc8dc17f930444f7Affected 5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before abe224e7077ae5d47f1208430ede4d99ae310627Affected 5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before 9b6325fc58ab877ecb97fc5642a39e071c343315Affected 5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before 95e1ad3f19dfec09eb4f4273cf7079fd9b35cee6Affected 5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before 067504c00fe175864652764308922d99e199828fAffected 5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before 0e4b5f8cad67eabf98da3f90b6443dcea5783ff3Affected 5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before 5cbc49d5c4cd20c18041e86958103045216d2190Affected
LinuxLinux	5.2Affected before 5.2Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.110 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before ea79c01ef23c2ec3ace8a98ada517d56763814c2Affected
5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before beaf45d9a10e7c1de86dcd1cbc8dc17f930444f7Affected
5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before abe224e7077ae5d47f1208430ede4d99ae310627Affected
5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before 9b6325fc58ab877ecb97fc5642a39e071c343315Affected
5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before 95e1ad3f19dfec09eb4f4273cf7079fd9b35cee6Affected
5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before 067504c00fe175864652764308922d99e199828fAffected
5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before 0e4b5f8cad67eabf98da3f90b6443dcea5783ff3Affected
5fa8774c7f38c79f38b672c1a0db0c049da477d6 to before 5cbc49d5c4cd20c18041e86958103045216d2190Affected

LinuxLinux

5.2Affected
before 5.2Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.110 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.