CVE-2026-90031 Overview
CVE-2026-90031 is a race condition in the Linux kernel's ene_ub6250 USB storage driver. The flaw occurs between the driver's probe routine and the delayed scan work that usb_stor_probe2() schedules. Both ene_get_card_type() and the scan work path use the shared us->current_urb field, but only the scan work serializes access through us->dev_mutex. When the two run concurrently, usb_submit_urb() emits a warning that the URB is already active, indicating unsafe concurrent USB Request Block (URB) submission on the same endpoint. The upstream fix serializes ene_get_card_type() with us->dev_mutex, matching the locking used by the scan path.
Critical Impact
Concurrent URB submission in the ene_ub6250 driver can produce kernel warnings and unstable USB storage behavior when a vulnerable card reader is attached.
Affected Products
- Linux kernel builds shipping the usb-storageene_ub6250 driver prior to the fix commits
- Distributions consuming affected mainline and stable kernel branches
- Systems that expose the ene_ub6250 code path through attached ENE UB6250 card readers
Discovery Timeline
- 2026-09-16 - CVE-2026-90031 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-90031
Vulnerability Analysis
The ene_ub6250_probe() function calls usb_stor_probe2(), which initializes the usb-storage infrastructure and schedules a delayed scan work item. After scheduling, the probe continues by invoking ene_get_card_type(), which issues an ENE command through ene_send_scsi_cmd() and the usb-storage bulk transfer helpers.
Both paths operate on us->current_urb. The scan work reaches this field via usb_stor_Bulk_max_lun() and takes us->dev_mutex before use. The probe-side call to ene_get_card_type() does not acquire that mutex. As a result, the scan work can run while the probe is still using the URB, producing a warning from usb_submit_urb() that the URB is already active. This constitutes a classic driver-level race condition on shared URB state.
Root Cause
The root cause is inconsistent locking discipline around us->current_urb. One caller honors us->dev_mutex while the other does not, leaving the shared URB unprotected during probe. The mismatch violates the serialization contract expected by the usb-storage bulk transfer helpers.
Attack Vector
Exploitation requires local physical or logical access to attach a USB device that binds to the ene_ub6250 driver. The race triggers during device probe, so it is reachable only when the vulnerable driver initializes hardware. No remote network vector is described in the advisory.
Refer to the upstream patches for the exact code changes, including Kernel Commit 1c67f2b and Kernel Commit 445fc36.
Detection Methods for CVE-2026-90031
Indicators of Compromise
- Kernel log entries from usb_submit_urb() warning that a URB is already active during ene_ub6250 probe
- WARN_ON stack traces originating in usb-storage bulk transfer helpers or usb_stor_Bulk_max_lun
- USB storage device enumeration failures or retries when an ENE UB6250 reader is attached
Detection Strategies
- Parse dmesg and journal logs for usb_submit_urb warnings correlated with ene_ub6250 module load events
- Track kernel version and module inventory to identify hosts running unpatched ene_ub6250 builds
- Alert on repeated USB storage probe failures on endpoints that expose card reader hardware
Monitoring Recommendations
- Forward kernel ring buffer telemetry to a central log platform for pattern matching on URB warnings
- Include kernel and driver version fields in endpoint inventory queries to prioritize patch rollouts
- Correlate USB device insertion events with subsequent kernel warnings to identify affected hosts
How to Mitigate CVE-2026-90031
Immediate Actions Required
- Update to a kernel build that includes the upstream fix serializing ene_get_card_type() with us->dev_mutex
- Track distribution advisories and apply vendor-provided stable kernel updates
- Restrict physical USB access on systems that cannot be patched immediately
Patch Information
The fix is available in multiple stable branches. Reference commits include Kernel Commit 5082546, Kernel Commit 8936d95, Kernel Commit 9481bc0, Kernel Commit 996c319, Kernel Commit 9c261a8, and Kernel Commit 9cd335f. The patch acquires us->dev_mutex around the ENE card-type probe to match the locking used by the scan path.
Workarounds
- Blacklist the ene_ub6250 module on systems that do not require ENE UB6250 card reader support
- Enforce USB device control policies to prevent attachment of unapproved storage or card reader devices
- Prioritize kernel updates on shared or kiosk systems where USB media attachment is routine
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
