Cloudanix VulnDB

CVE-2026-99202

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux storage handling can cause servers to freeze when waking up from low-power states if they use certain disk expanders.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition deadlock in libsas smp_execute_task_sg() when pm_runtime_get_sync() is called from the HA resume path for expander-attached SATA disks, blocking sas_drain_work() and preventing completion of SMP PHY CONTROL resets.

Why it matters to the business

Systems using SAS expanders with SATA disks may experience hangs during power management resume events, leading to unplanned downtime and requiring manual intervention or reboot.

How an attack unfolds

An attacker or automated power event triggers host adapter resume while an SMP command is in flight; the get_sync() waits for RPM_RESUMING state while the resume path blocks on the same IO, deadlocking the system. No external threat actors or ransomware campaigns are associated.

How to fix it

Apply the upstream fix replacing pm_runtime_get_sync()/put_sync() with pm_runtime_get_noresume()/put() and using pm_runtime_resume_and_get() only on the BSG path; monitor kernel changelogs for backports to affected distributions.

How to confirm the fix worked

Confirm the patch is present by inspecting libsas.c for the updated pm_runtime calls; reproduce resume sequences with expander-attached SATA devices under load to verify absence of deadlock.

Typical attack path

  1. Trigger sas_resume_ha() via power management or device event
  2. Initiate DISCE_RESUME leading to sas_resume_sata() and ata_sas_port_resume() requesting ATA_EH_RESET
  3. Route hard reset through SMP PHY CONTROL via smp_execute_task_sg()
  4. Encounter deadlock when pm_runtime_get_sync() blocks on ongoing resume

How to detect it

Review kernel logs for hung task or deadlock warnings referencing sas_drain_work, smp_execute_task_sg, or pm_runtime during resume; correlate with SATA device reset attempts on expander-attached disks.

What your security team should do

  • Prioritize kernel updates containing the libsas fix on all systems with SAS HBAs and expanders
  • Test resume behavior on representative hardware before broad deployment
  • Monitor for related deadlock reports in vendor advisories given the one-day publication age

The record

In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix SMP IO deadlock during HA resume smp_execute_task_sg() calls pm_runtime_get_sync() on the host before issuing an SMP command. When that command is itself issued from the HA resume path, the get_sync() deadlocks: it waits for the ongoing resume (the device is RPM_RESUMING), while the resume is blocked in sas_drain_work() waiting for that same SMP IO to complete. The deadlock needs an expander-attached SATA disk. During sas_resume_ha() -> sas_drain_work(), DISCE_RESUME -> sas_resume_sata() -> ata_sas_port_resume() requests ATA_EH_RESET, and the hard reset for such a disk is done via SMP PHY CONTROL (sas_ata_hard_reset() -> sas_phy_reset() -> sas_smp_phy_control() -> smp_execute_task_sg()). Direct-attached SATA resets through lldd_control_phy() and SSP devices use TMFs, so neither hits this. Replace the get_sync()/put_sync() pair with pm_runtime_get_noresume()/pm_runtime_put(). smp_execute_task_sg() only needs to hold off autosuspend while the SMP is in flight, and it must not try to resume the host: a sync resume issued from the HA resume path itself is what deadlocks, and by the time sas_resume_ha() runs, hw_init has already reinitialized the hardware, so the device is accessible without one. The usage reference is still required. Discovery work normally runs inside an event worker's PM reference, taken at sas_notify_port_event() notify time and held until the handler has flushed the disco queue. sas_rediscover_ex_phy() however requeues DISCE_REVALIDATE_DOMAIN from within the revalidation worker itself, and flush_workqueue() does not wait for work items queued during execution, so that chained revalidation runs with no outer PM reference - without the get_noresume(), its SMP could race autosuspend. For the BSG path, sas_smp_handler() is the only caller which may find the host autosuspended: expander SMP requests do not go through any SCSI device request queue, so nothing else in that path holds the host awake. Resume it there with pm_runtime_resume_and_get() and check the result.

Affected packages

Ecosystem Package Introduced Fixed