Executive brief
The Linux kernel's SCSI error handling subsystem contains a race condition in runtime power management (PM) reference counting. When power management code and error handling threads race, the system can skip acquiring a runtime PM reference while still releasing one, causing an underflow condition that destabilizes power management state and may lead to system hangs or crashes.
Technical details
The vulnerability is a race condition in the SCSI error handling subsystem (drivers/scsi/scsi_error.c). The `shost->eh_noresume` flag is consulted twice per error handling iteration—once before `scsi_autopm_get_host()` and again before `scsi_autopm_put_host()`—without synchronization. When a power management code path (e.g., ufshcd_set_dev_pwr_mode) flips `eh_noresume` between these two checks, an error handler iteration can skip the runtime PM get but still execute the runtime PM put, leaving an unmatched reference that underflows the usage counter. The fix snapshots `eh_noresume` once per iteration using `READ_ONCE()` and uses that snapshot for both decisions, eliminating the window. Local system context is required to trigger the race via concurrent PM and error handling operations.
Affected products
- Linux Linux Kernel multiple versions (Linux 2.6.11 through 6.9 and later)
Timeline
- 2026-08-26: disclosed: CVE-2026-74754 published to NVD
- 2026-08-07: patched: Patch merged by Martin K. Petersen (commit 872f486259ae0bc6b73ca4735a15d013241f73e9)
- 2026-07-29: other: Original commit authored by Hongjie Fang