Executive brief
A vulnerability in the Linux kernel's storage management system can cause the operating system to hang or become unresponsive when a storage device (like an NVMe drive) is unexpectedly disconnected. This occurs because the system tries to save data to a device that is no longer there, leading to a permanent wait state. This can result in a denial of service, impacting system availability and requiring a hard reboot to recover.
Technical details
A regression in the Linux kernel block layer's bdev_mark_dead() function causes a kernel hang during surprise device removal. When a device is unexpectedly removed, the code path for bare block devices (lacking a specific ->mark_dead operator) fails to check the 'surprise' flag and unconditionally calls sync_blockdev(). This triggers folio_wait_writeback(), which waits indefinitely for I/O operations that can never complete because the hardware is gone. This 'wedges' the reset worker and any dependent tasks, leading to a local denial of service. The fix restores the check to skip synchronization when a device is already unreachable.
Affected products
- Linux Linux Kernel 6.6 to 6.6.145, 6.12 to 6.12.96, 6.18 to 6.18.39, 7.1 to 7.1.4
Timeline
- 2026-05-22: other: Initial patch submitted
- 2026-07-25: disclosed: CVE published
- 2026-07-24: patched: Final stable tree commits applied
References
- https://git.kernel.org/stable/c/49f06cff50a4ccf3b7a1a662ceb892b3b21a527a
- https://git.kernel.org/stable/c/9818bcae3c0ca1dde4b9a334125c46676e0a9b29
- https://git.kernel.org/stable/c/aa4c4a9315764b2b7a7182e72cc5ea87520436b4
- https://git.kernel.org/stable/c/d6998ddd507c81e3829489a6ead23f17f5acb7fe
- https://git.kernel.org/stable/c/f41cf35ee2a1e31374b3f54e7579c55153506e70