GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74555 (GCVE-0-2026-74555)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:28 – Updated: 2026-08-19 16:38
VLAI
Title
scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race Commit fbefe22811c3 ("scsi: libsas: Don't always drain event workqueue for HA resume") introduced sas_resume_ha_no_sync() to avoid a deadlock: the PHYE_RESUME_TIMEOUT handler, running on the HA event workqueue, calls sas_deform_port() -> sas_destruct_devices(), which removes SCSI devices and waits for the host to become runtime-active. But the host cannot resume until sas_resume_ha() -> sas_drain_work() returns, and the drain is blocked on that very handler. However skipping the drain reintroduces a race: hisi_sas returns from resume before all PHY UP work and libsas discovery work finish. The controller may then autosuspend while disks are still waking up. The disks issue IO to a suspended controller, the IO fails, and the disks get disabled. Fix the deadlock at its source by moving the PHYE_RESUME_TIMEOUT notification to after sas_drain_work(). By then the host resume is about to complete, so device removal through device_link no longer blocks on the resume and the cycle is broken. With the deadlock gone, restore sas_resume_ha() (the draining variant) in hisi_sas and remove sas_resume_ha_no_sync(). The reorder is safe for the other libsas consumers (isci, pm8001, aic94xx, mvsas). During suspend, sas_suspend_devices() calls sas_notify_lldd_dev_gone() for each device, which sets dev->lldd_dev to NULL. When scsi_unblock_requests re-enables I/O in resume, any I/O to a timed-out phy's disk is immediately rejected by the LLDD before reaching hardware: isci returns SAS_DEVICE_UNKNOWN (mapped to DID_BAD_TARGET), and pm8001 returns SAS_PHY_DOWN (mapped to DID_NO_CONNECT). Both complete directly via scsi_done() without entering SCSI EH. This is identical in both the old and new ordering since lldd_dev_gone runs during suspend, before resume. The reorder only affects when the PHYE_RESUME_TIMEOUT handler runs (synchronized by sas_drain_work() vs. asynchronous after resume returns), not whether I/O can reach the device. aic94xx and mvsas do not register any PM ops and never reach this code path.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fbefe22811c3140a686e407e114789ebf328a9a2 , < 09357f067122e2e28ec52e27013a1660a1571618 (git)
Affected: fbefe22811c3140a686e407e114789ebf328a9a2 , < e50a6523a603594a6d92cdecfe11997d639410a3 (git)
Affected: fbefe22811c3140a686e407e114789ebf328a9a2 , < c391b5899dd46485a5893696c12ae3e95a3a7325 (git)
Affected: fbefe22811c3140a686e407e114789ebf328a9a2 , < 9e24b47ef81d43b3fb1b14294f09991640c79fcc (git)
Affected: fbefe22811c3140a686e407e114789ebf328a9a2 , < b9c44a14062093e9fc2d6bddc696cfceadb482d7 (git)
Affected: fbefe22811c3140a686e407e114789ebf328a9a2 , < 3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.151 , ≤ 6.6.* (semver)
Unaffected: 6.12.103 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c",
            "drivers/scsi/libsas/sas_init.c",
            "include/scsi/libsas.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "09357f067122e2e28ec52e27013a1660a1571618",
              "status": "affected",
              "version": "fbefe22811c3140a686e407e114789ebf328a9a2",
              "versionType": "git"
            },
            {
              "lessThan": "e50a6523a603594a6d92cdecfe11997d639410a3",
              "status": "affected",
              "version": "fbefe22811c3140a686e407e114789ebf328a9a2",
              "versionType": "git"
            },
            {
              "lessThan": "c391b5899dd46485a5893696c12ae3e95a3a7325",
              "status": "affected",
              "version": "fbefe22811c3140a686e407e114789ebf328a9a2",
              "versionType": "git"
            },
            {
              "lessThan": "9e24b47ef81d43b3fb1b14294f09991640c79fcc",
              "status": "affected",
              "version": "fbefe22811c3140a686e407e114789ebf328a9a2",
              "versionType": "git"
            },
            {
              "lessThan": "b9c44a14062093e9fc2d6bddc696cfceadb482d7",
              "status": "affected",
              "version": "fbefe22811c3140a686e407e114789ebf328a9a2",
              "versionType": "git"
            },
            {
              "lessThan": "3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845",
              "status": "affected",
              "version": "fbefe22811c3140a686e407e114789ebf328a9a2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/hisi_sas/hisi_sas_v3_hw.c",
            "drivers/scsi/libsas/sas_init.c",
            "include/scsi/libsas.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race\n\nCommit fbefe22811c3 (\"scsi: libsas: Don\u0027t always drain event workqueue\nfor HA resume\") introduced sas_resume_ha_no_sync() to avoid a deadlock:\nthe PHYE_RESUME_TIMEOUT handler, running on the HA event workqueue,\ncalls sas_deform_port() -\u003e sas_destruct_devices(), which removes SCSI\ndevices and waits for the host to become runtime-active. But the host\ncannot resume until sas_resume_ha() -\u003e sas_drain_work() returns, and the\ndrain is blocked on that very handler.\n\nHowever skipping the drain reintroduces a race: hisi_sas returns from\nresume before all PHY UP work and libsas discovery work finish. The\ncontroller may then autosuspend while disks are still waking up. The\ndisks issue IO to a suspended controller, the IO fails, and the disks\nget disabled.\n\nFix the deadlock at its source by moving the PHYE_RESUME_TIMEOUT\nnotification to after sas_drain_work(). By then the host resume is about\nto complete, so device removal through device_link no longer blocks on\nthe resume and the cycle is broken.\n\nWith the deadlock gone, restore sas_resume_ha() (the draining variant)\nin hisi_sas and remove sas_resume_ha_no_sync().\n\nThe reorder is safe for the other libsas consumers (isci, pm8001,\naic94xx, mvsas). During suspend, sas_suspend_devices() calls\nsas_notify_lldd_dev_gone() for each device, which sets dev-\u003elldd_dev to\nNULL. When scsi_unblock_requests re-enables I/O in resume, any I/O to a\ntimed-out phy\u0027s disk is immediately rejected by the LLDD before reaching\nhardware: isci returns SAS_DEVICE_UNKNOWN (mapped to DID_BAD_TARGET),\nand pm8001 returns SAS_PHY_DOWN (mapped to DID_NO_CONNECT). Both\ncomplete directly via scsi_done() without entering SCSI EH. This is\nidentical in both the old and new ordering since lldd_dev_gone runs\nduring suspend, before resume. The reorder only affects when the\nPHYE_RESUME_TIMEOUT handler runs (synchronized by sas_drain_work()\nvs. asynchronous after resume returns), not whether I/O can reach the\ndevice. aic94xx and mvsas do not register any PM ops and never reach\nthis code path."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:38:54.912Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/09357f067122e2e28ec52e27013a1660a1571618"
        },
        {
          "url": "https://git.kernel.org/stable/c/e50a6523a603594a6d92cdecfe11997d639410a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/c391b5899dd46485a5893696c12ae3e95a3a7325"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e24b47ef81d43b3fb1b14294f09991640c79fcc"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9c44a14062093e9fc2d6bddc696cfceadb482d7"
        },
        {
          "url": "https://git.kernel.org/stable/c/3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845"
        }
      ],
      "title": "scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74555",
    "datePublished": "2026-08-15T12:28:00.729Z",
    "dateReserved": "2026-08-15T05:44:03.916Z",
    "dateUpdated": "2026-08-19T16:38:54.912Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74555",
      "date": "2026-09-04",
      "epss": "0.00161",
      "percentile": "0.05564"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:57:28.000Z",
      "cve": "CVE-2026-74555",
      "id": "msrc_CVE-2026-74555",
      "initial_release_date": "2026-08-23T14:57:28.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74555.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74555\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T13:18:00.927\",\"lastModified\":\"2026-08-19T17:21:10.613\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race\\n\\nCommit fbefe22811c3 (\\\"scsi: libsas: Don\u0027t always drain event workqueue\\nfor HA resume\\\") introduced sas_resume_ha_no_sync() to avoid a deadlock:\\nthe PHYE_RESUME_TIMEOUT handler, running on the HA event workqueue,\\ncalls sas_deform_port() -\u003e sas_destruct_devices(), which removes SCSI\\ndevices and waits for the host to become runtime-active. But the host\\ncannot resume until sas_resume_ha() -\u003e sas_drain_work() returns, and the\\ndrain is blocked on that very handler.\\n\\nHowever skipping the drain reintroduces a race: hisi_sas returns from\\nresume before all PHY UP work and libsas discovery work finish. The\\ncontroller may then autosuspend while disks are still waking up. The\\ndisks issue IO to a suspended controller, the IO fails, and the disks\\nget disabled.\\n\\nFix the deadlock at its source by moving the PHYE_RESUME_TIMEOUT\\nnotification to after sas_drain_work(). By then the host resume is about\\nto complete, so device removal through device_link no longer blocks on\\nthe resume and the cycle is broken.\\n\\nWith the deadlock gone, restore sas_resume_ha() (the draining variant)\\nin hisi_sas and remove sas_resume_ha_no_sync().\\n\\nThe reorder is safe for the other libsas consumers (isci, pm8001,\\naic94xx, mvsas). During suspend, sas_suspend_devices() calls\\nsas_notify_lldd_dev_gone() for each device, which sets dev-\u003elldd_dev to\\nNULL. When scsi_unblock_requests re-enables I/O in resume, any I/O to a\\ntimed-out phy\u0027s disk is immediately rejected by the LLDD before reaching\\nhardware: isci returns SAS_DEVICE_UNKNOWN (mapped to DID_BAD_TARGET),\\nand pm8001 returns SAS_PHY_DOWN (mapped to DID_NO_CONNECT). Both\\ncomplete directly via scsi_done() without entering SCSI EH. This is\\nidentical in both the old and new ordering since lldd_dev_gone runs\\nduring suspend, before resume. The reorder only affects when the\\nPHYE_RESUME_TIMEOUT handler runs (synchronized by sas_drain_work()\\nvs. asynchronous after resume returns), not whether I/O can reach the\\ndevice. aic94xx and mvsas do not register any PM ops and never reach\\nthis code path.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/hisi_sas/hisi_sas_v3_hw.c\",\"drivers/scsi/libsas/sas_init.c\",\"include/scsi/libsas.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fbefe22811c3140a686e407e114789ebf328a9a2\",\"lessThan\":\"09357f067122e2e28ec52e27013a1660a1571618\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fbefe22811c3140a686e407e114789ebf328a9a2\",\"lessThan\":\"e50a6523a603594a6d92cdecfe11997d639410a3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fbefe22811c3140a686e407e114789ebf328a9a2\",\"lessThan\":\"c391b5899dd46485a5893696c12ae3e95a3a7325\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fbefe22811c3140a686e407e114789ebf328a9a2\",\"lessThan\":\"9e24b47ef81d43b3fb1b14294f09991640c79fcc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fbefe22811c3140a686e407e114789ebf328a9a2\",\"lessThan\":\"b9c44a14062093e9fc2d6bddc696cfceadb482d7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fbefe22811c3140a686e407e114789ebf328a9a2\",\"lessThan\":\"3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/hisi_sas/hisi_sas_v3_hw.c\",\"drivers/scsi/libsas/sas_init.c\",\"include/scsi/libsas.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.151\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.103\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/09357f067122e2e28ec52e27013a1660a1571618\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3dbbbf656b850c9c8de05df6ad4a1dfc6ff02845\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9e24b47ef81d43b3fb1b14294f09991640c79fcc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b9c44a14062093e9fc2d6bddc696cfceadb482d7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c391b5899dd46485a5893696c12ae3e95a3a7325\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e50a6523a603594a6d92cdecfe11997d639410a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-19T05:25:42+00:00",
      "cve": "CVE-2026-74555",
      "id": "CVE-2026-74555",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: libsas: Fix HA resume deadlock and hisi_sas disk-wake race",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74555.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.