CVE-2026-68396

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: wake eh reliably when using scsi_schedule_eh

Drivers which use the scsi_schedule_eh function to run the error handler

currently risk the error handler thread never waking once all commands are

timed out or inactive. There is no enforced memory order between setting

the host into error recovery state and counting busy commands. This can

result in a race with scsi_dec_host_busy where neither CPU sees both

conditions of all commands inactive and the host error state to request

waking the error handler.

To fix this, run the scsi_schedule_eh's scsi_eh_wakeup from a new work item

which will use rcu to ensure scsi_schedule_eh's call to scsi_host_busy will

occur after the error state is globally visible and will be seen by any

current scsi_dec_host_busy callers.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References