Cloudanix VulnDB

CVE-2026-64003

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug can cause storage devices to get stuck during error handling, making systems unresponsive until fixed.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw causes scsi_run_host_queues() to skip devices in SDEV_CANCEL state during SCSI recovery, leaving requeued commands unprocessed and causing device removal to hang.

Why it matters to the business

Storage device operations can stall, leading to system hangs, degraded I/O performance, and potential need for manual intervention or reboots in environments using SCSI storage.

How an attack unfolds

An attacker with local access triggers SCSI error recovery on a host, then forces device removal or cancellation for affected devices, exploiting the incomplete queue processing to leave requests stuck.

How to fix it

Apply the upstream kernel patch modifying scsi_run_host_queues() to process all devices except those in SDEV_DEL state or without reference; upgrade to a kernel containing this change.

How to confirm the fix worked

Inspect the scsi_run_host_queues() implementation in the running kernel source to confirm it no longer relies solely on shost_for_each_device() and handles non-SDEV_DEL states.

Typical attack path

  1. Gain local access to trigger SCSI error recovery state on a host
  2. Initiate device removal or cancellation while recovery is active
  3. Observe stuck requeued commands due to skipped SDEV_CANCEL devices
  4. Cause removal process to hang indefinitely

How to detect it

Review kernel logs for SCSI recovery events followed by device removal hangs; check for processes blocked on SCSI queue processing.

What your security team should do

  • Prioritize kernel updates containing the SCSI core fix in affected distributions
  • Test SCSI device hotplug and error recovery scenarios in staging environments
  • Monitor system logs for hung removal processes during storage maintenance

The record

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues While a SCSI host is in a recovery state, scsi_mq_requeue_cmd() will not set the requeue list for a requeued command to be kicked in the future. The expectation is a call to scsi_run_host_queues() will kick all SCSI devices once the recovery state is cleared. However, scsi_run_host_queues() uses shost_for_each_device() which uses scsi_device_get() and so will ignore devices in a partially removed state like SDEV_CANCEL. But these devices may also have requeued requests, leaving their requests stuck from not being kicked and causing the removal process of the device to hang. scsi_run_host_queues() needs to run against more devices than the macro shost_for_each_device() allows. Instead of using the too limiting scsi_device_get() state checks, only ignore devices in SDEV_DEL state or when unable to acquire a reference. Attempt to run the queues for all other devices when scsi_run_host_queues() is called.

Affected packages

Ecosystem Package Introduced Fixed