CVE-2026-89855

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Serialize flash version read in reset handler

The "update cache versions without reset" sysfs reset operation (0x20261)

calls get_flash_version(), which reads hardware flash registers, without

holding ha->optrom_mutex. The VPD update path serializes the same call

under optrom_mutex, so this reset path can interleave its flash register

accesses with a concurrent VPD or optrom flash operation and corrupt the

reads.

Hold ha->optrom_mutex across the get_flash_version() call to match the

VPD update path.