CVE-2026-90031: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-5fv5-xjmm-vvx9
Share
Published
Advisory Summary

CVE-2026-90031 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-90031 at a Glance

CVE Identifier CVE-2026-90031
GHSA Identifier GHSA-5fv5-xjmm-vvx9
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-90031

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-90031, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: usb-storage: ene_ub6250: fix race between scan work and probe ene_ub6250_probe() calls usb_stor_probe2(), which starts the usb-storage infrastructure and schedules the delayed scan work. The driver then calls ene_get_card_type(), which sends an ENE command through ene_send_scsi_cmd() and the usb-storage bulk transfer helpers. Both the delayed scan work, through usb_stor_Bulk_max_lun(), and ene_get_card_type() use us->current_urb. The scan work serializes this access with us->dev_mutex, but the ENE card-type probe does not. If the scan work runs while ene_get_card_type() is still using us->current_urb, usb_submit_urb() warns that the URB is already active. Serialize ene_get_card_type() with us->dev_mutex, matching the locking used by the scan path.

References

NVD — CVE-2026-90031 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90031
git.kernel.org/stable/c/1c67f2ba9c... WEB
https://git.kernel.org/stable/c/1c67f2ba9c5f7c5ab3670671c0d51c6504bcaf74
git.kernel.org/stable/c/445fc368c6... WEB
https://git.kernel.org/stable/c/445fc368c6bc73eff0aeb3818cf5f355facfbb16
git.kernel.org/stable/c/5082546702... WEB
https://git.kernel.org/stable/c/5082546702c32a2700894d2c0ace784e038ef6a3
git.kernel.org/stable/c/8936d95dd0... WEB
https://git.kernel.org/stable/c/8936d95dd04d34db96d4d1e3899eee52605bbedc
git.kernel.org/stable/c/9481bc04a8... WEB
https://git.kernel.org/stable/c/9481bc04a8c351ed883a7f0e10939bbe9120ead7
git.kernel.org/stable/c/996c319b8b... WEB
https://git.kernel.org/stable/c/996c319b8bd5ada1f62daae0d331d0b23e0f2117
git.kernel.org/stable/c/9c261a8313... WEB
https://git.kernel.org/stable/c/9c261a83131e241d67cb73ab578d0265bc19cfb5
git.kernel.org/stable/c/9cd335f4f4... WEB
https://git.kernel.org/stable/c/9cd335f4f41e84d1ab88d80150ffee8dee9650d7

Frequently Asked Questions

What is CVE-2026-90031?
CVE-2026-90031 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-90031?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-90031?
CVE-2026-90031 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-90031?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5fv5-xjmm-vvx9",
  "modified" : "2026-09-16T12:30:46Z",
  "published" : "2026-09-16T12:30:46Z",
  "aliases" : [ "CVE-2026-90031" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nusb-storage: ene_ub6250: fix race between scan work and probe\n\nene_ub6250_probe() calls usb_stor_probe2(), which starts the usb-storage\ninfrastructure and schedules the delayed scan work.  The driver then\ncalls ene_get_card_type(), which sends an ENE command through\nene_send_scsi_cmd() and the usb-storage bulk transfer helpers.\n\nBoth the delayed scan work, through usb_stor_Bulk_max_lun(), and\nene_get_card_type() use us->current_urb.  The scan work serializes this\naccess with us->dev_mutex, but the ENE card-type probe does not.  If the\nscan work runs while ene_get_card_type() is still using us->current_urb,\nusb_submit_urb() warns that the URB is already active.\n\nSerialize ene_get_card_type() with us->dev_mutex, matching the locking\nused by the scan path.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-90031"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1c67f2ba9c5f7c5ab3670671c0d51c6504bcaf74"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/445fc368c6bc73eff0aeb3818cf5f355facfbb16"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/5082546702c32a2700894d2c0ace784e038ef6a3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8936d95dd04d34db96d4d1e3899eee52605bbedc"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9481bc04a8c351ed883a7f0e10939bbe9120ead7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/996c319b8bd5ada1f62daae0d331d0b23e0f2117"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9c261a83131e241d67cb73ab578d0265bc19cfb5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/9cd335f4f41e84d1ab88d80150ffee8dee9650d7"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-16T11:17:16Z"
  }
}