CVE-2026-74754

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: pair EH runtime PM get and put

shost->eh_noresume is currently consulted twice in one error handling

iteration: once before scsi_autopm_get_host() and once again before

scsi_autopm_put_host().

That is racy when a PM-triggered error path flips shost->eh_noresume

while the SCSI EH thread is still running.

The problem flow looks like this:

PM path

ufshcd_set_dev_pwr_mode()

shost->eh_noresume = 1

ufshcd_execute_start_stop <-- trigger EH

...

shost->eh_noresume = 0

EH path

scsi_error_handler()

if (!shost->eh_noresume)

scsi_autopm_get_host() <-- skipped

...

if (!shost->eh_noresume)

scsi_autopm_put_host() <-- executed later

In that case one EH iteration can skip autoresume on entry and still

drop a runtime PM reference on exit. That leaves an unmatched runtime PM

put and can trigger a runtime PM usage count underflow.

Fix this by making eh_noresume a regular bo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References