CVE-2026-90031

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

usb-storage: ene_ub6250: fix race between scan work and probe

ene_ub6250_probe() calls usb_stor_probe2(), which starts the usb-storage

infrastructure and schedules the delayed scan work. The driver then

calls ene_get_card_type(), which sends an ENE command through

ene_send_scsi_cmd() and the usb-storage bulk transfer helpers.

Both the delayed scan work, through usb_stor_Bulk_max_lun(), and

ene_get_card_type() use us->current_urb. The scan work serializes this

access with us->dev_mutex, but the ENE card-type probe does not. If the

scan work runs while ene_get_card_type() is still using us->current_urb,

usb_submit_urb() warns that the URB is already active.

Serialize ene_get_card_type() with us->dev_mutex, matching the locking

used by the scan path.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References