CVE-2026-64003

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues

While a SCSI host is in a recovery state, scsi_mq_requeue_cmd() will not

set the requeue list for a requeued command to be kicked in the future.

The expectation is a call to scsi_run_host_queues() will kick all SCSI

devices once the recovery state is cleared.

However, scsi_run_host_queues() uses shost_for_each_device() which uses

scsi_device_get() and so will ignore devices in a partially removed

state like SDEV_CANCEL. But these devices may also have requeued

requests, leaving their requests stuck from not being kicked and causing

the removal process of the device to hang.

scsi_run_host_queues() needs to run against more devices than the macro

shost_for_each_device() allows. Instead of using the too limiting

scsi_device_get() state checks, only ignore devices in SDEV_DEL state or

when unable to acquire a reference. Attempt to run the que

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References