CVE-2026-74555

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race

Commit fbefe22811c3 ("scsi: libsas: Don't always drain event workqueue

for HA resume") introduced sas_resume_ha_no_sync() to avoid a deadlock:

the PHYE_RESUME_TIMEOUT handler, running on the HA event workqueue,

calls sas_deform_port() -> sas_destruct_devices(), which removes SCSI

devices and waits for the host to become runtime-active. But the host

cannot resume until sas_resume_ha() -> sas_drain_work() returns, and the

drain is blocked on that very handler.

However skipping the drain reintroduces a race: hisi_sas returns from

resume before all PHY UP work and libsas discovery work finish. The

controller may then autosuspend while disks are still waking up. The

disks issue IO to a suspended controller, the IO fails, and the disks

get disabled.

Fix the deadlock at its source by moving the PHYE_RESUME_TIMEOUT

notification to after sas_drain_work(). By t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References