CVE-2026-89855

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Serialize flash version read in reset handler

The "update cache versions without reset" sysfs reset operation (0x20261)

calls get_flash_version(), which reads hardware flash registers, without

holding ha->optrom_mutex. The VPD update path serializes the same call

under optrom_mutex, so this reset path can interleave its flash register

accesses with a concurrent VPD or optrom flash operation and corrupt the

reads.

Hold ha->optrom_mutex across the get_flash_version() call to match the

VPD update path.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References