CVE intelligence
CVE-2026-90285
Vulnerability intelligence
Published Sep 17, 2026 Sources checked Nov 11, 2026
N/A CVSS not listed Score unavailable
What this means
Review the available evidence
CVE-2026-90285. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.
What to do next Remediation and response
CISA KEV Not listed Based on the latest collected catalog
EPSS 0.2% Estimated 30-day exploitation probability
Ransomware use Not marked CISA KEV ransomware field
Threat actors 0 Source-linked actor relationships
Overview
What is CVE-2026-90285? In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path
qla2x00_sysfs_read_vpd() called ha->isp_ops->read_optrom() a second time after releasing optrom_mutex. The repeated read is redundant and, unlike the first, runs without optrom_mutex held, exposing flash access to concurrent optrom operations.
Drop the duplicate call.
Source: NVD
Sources Check the original records SecurityAlert keeps CVSS, KEV, EPSS, vendor guidance, and actor links separate so you can see where each fact came from.