Executive brief
A race condition in the Linux kernel's SCSI subsystem can cause storage operations to become permanently stuck. This occurs when the system fails to properly trigger error handling routines during high-traffic or complex I/O failures. For an organization, this could lead to a denial-of-service state where servers or industrial controllers lose the ability to read or write data to their storage disks, potentially halting business operations or industrial processes.
Technical details
A race condition exists in the Linux kernel SCSI core due to improper memory ordering and synchronization between scsi_dec_host_busy() and scsi_eh_inc_host_failed(). Specifically, the clearing of the SCMD_STATE_INFLIGHT bit can be reordered relative to host busy counts, or the busy count may be checked before the failed count is incremented. This results in a state where the SCSI error handler is never signaled to advance, causing all I/O through the affected SCSI host to hang. The fix introduces a memory barrier (smp_mb()) and reorders the host_failed increment to ensure visibility across CPUs. Patch availability is confirmed across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 6eb045e092ef to cc872e35c0df80062abc71268d690a2f749e542e
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2026-02-04: advisory: Initial NVD publication
- 2026-01-30: patched: Patches committed to stable kernel trees
References
- https://git.kernel.org/stable/c/219f009ebfd1ef3970888ee9eef4c8a06357f862
- https://git.kernel.org/stable/c/64ae21b9c4f0c7e60cf47a53fa7ab68852079ef0
- https://git.kernel.org/stable/c/6d9a367be356101963c249ebf10ea10b32886607
- https://git.kernel.org/stable/c/9fdc6f28d5e81350ab1d2cac8389062bd09e61e1
- https://git.kernel.org/stable/c/cc872e35c0df80062abc71268d690a2f749e542e
- https://git.kernel.org/stable/c/fe2f8ad6f0999db3b318359a01ee0108c703a8c3
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html