Junglewise Threat Intelligence

CVE-2026-23110: Linux Kernel race condition in SCSI core error handling

CVE-2026-23110 · Severity: medium · CVSS 4.7 · Published 2026-02-04

Technologies: Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Linux, Siemens.

Executive brief

A race condition in the Linux kernel's SCSI subsystem can cause storage operations to become permanently stuck. This occurs when the system fails to properly trigger error handling routines during high-traffic or complex I/O failures. For an organization, this could lead to a denial-of-service state where servers or industrial controllers lose the ability to read or write data to their storage disks, potentially halting business operations or industrial processes.

Technical details

A race condition exists in the Linux kernel SCSI core due to improper memory ordering and synchronization between scsi_dec_host_busy() and scsi_eh_inc_host_failed(). Specifically, the clearing of the SCMD_STATE_INFLIGHT bit can be reordered relative to host busy counts, or the busy count may be checked before the failed count is incremented. This results in a state where the SCSI error handler is never signaled to advance, causing all I/O through the affected SCSI host to hang. The fix introduces a memory barrier (smp_mb()) and reorders the host_failed increment to ensure visibility across CPUs. Patch availability is confirmed across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 6eb045e092ef to cc872e35c0df80062abc71268d690a2f749e542e
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2026-02-04: advisory: Initial NVD publication
  • 2026-01-30: patched: Patches committed to stable kernel trees

References

Related threats