CVE-2026-90031

What the bug is

ene_ub6250_probe() calls usb_stor_probe2(), which starts the usb-storage infrastructure and schedules the delayed scan work. The driver then calls ene_get_card_type(), which sends an ENE command through ene_send_scsi_cmd() and the usb-storage bulk transfer helpers. Both the delayed scan work, through usb_stor_Bulk_max_lun(), and ene_get_card_type() use us->current_urb. The scan work serializes this access with us->dev_mutex, but the ENE card-type probe does not. If the scan work runs while ene_get_card_type() is still using us->current_urb, usb_submit_urb() warns that the URB is already active. Serialize ene_get_card_type() with us->dev_mutex, matching the locking used by the scan path.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

drivers/usb/storage/ene_ub6250.c

What this is

USB MASS STORAGE DRIVERMAINTAINERS section matched on drivers/usb/storage/ · linux-usb@vger.kernel.org · Maintained

Kernel module

ums_eneub6250

Check it on the machine

grep -wE 'CONFIG_OF|CONFIG_PCI|CONFIG_USB|CONFIG_USB_GADGET|CONFIG_USB_PHY|CONFIG_USB_STORAGE|CONFIG_USB_STORAGE_ENE_UB6250|CONFIG_USB_SUPPORT' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w ums_eneub6250

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

• bookwormMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, i386/686, i386/686-pae, i386/rt/686-pae, ppc64el/powerpc64le
• trixieMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, armel/rpi, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
• forky, sidMnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt-amd64, arm64/cloud-arm64, loong64/loong64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k, s390x/s390x
• bookworm · linux-6.12Mnot built on amd64/amd64, amd64/cloud-amd64, amd64/rt/amd64, arm64/cloud-arm64, ppc64el/powerpc64le, ppc64el/powerpc64le-64k

M

a module where it is built at all; some flavours do not build it

Build switches

CONFIG_OF, CONFIG_PCI, CONFIG_USB, CONFIG_USB_GADGET, CONFIG_USB_PHY, CONFIG_USB_STORAGE, CONFIG_USB_STORAGE_ENE_UB6250, CONFIG_USB_SUPPORT

Reads as

all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-09-16 (33 days ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.20%, higher than 8.7% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

drivers/usb

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
2.6.39	5.10.270	9cd335f4f41e
2.6.39	5.15.221	8936d95dd04d
2.6.39	6.1.188	9c261a83131e
2.6.39	6.6.157	9481bc04a8c3
2.6.39	6.12.110	5082546702c3
2.6.39	6.18.51	1c67f2ba9c5f
2.6.39	7.2.5	996c319b8bd5
2.6.39	7.3	445fc368c6bc

Debian advisories