CVE-2026-89855

A flaw was found in the Linux kernel's scsi: qla2xxx component. A local attacker could exploit a race condition in the flash version read handler. By concurrently triggering a sysfs reset operation and other flash operations, an attacker could corrupt flash register reads. This could lead to data integrity issues or system instability.

This vulnerability is rated as Low severity because triggering the synchronization issue requires local access to a host equipped with physical QLogic Fibre Channel adapters and simultaneous privileged sysfs operations. In typical enterprise environments, the affected driver is only loaded when corresponding storage hardware is physically attached. Furthermore, interacting with adapter reset attributes in sysfs requires administrative privileges, which restricts potential impact to systems where concurrent management tasks are initiated by authorized users.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.