CVE-2026-74754 (GCVE-0-2026-74754)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-26 14:37
VLAI
Title
scsi: core: pair EH runtime PM get and put
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: core: pair EH runtime PM get and put shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host(). That is racy when a PM-triggered error path flips shost->eh_noresume while the SCSI EH thread is still running. The problem flow looks like this: PM path ufshcd_set_dev_pwr_mode() shost->eh_noresume = 1 ufshcd_execute_start_stop <-- trigger EH ... shost->eh_noresume = 0 EH path scsi_error_handler() if (!shost->eh_noresume) scsi_autopm_get_host() <-- skipped ... if (!shost->eh_noresume) scsi_autopm_put_host() <-- executed later In that case one EH iteration can skip autoresume on entry and still drop a runtime PM reference on exit. That leaves an unmatched runtime PM put and can trigger a runtime PM usage count underflow. Fix this by making eh_noresume a regular bool so it can be accessed with READ_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use that snapshot for both runtime PM get and put decisions.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ae0751ffc77e7f21629970fdab5528c573e637f8 , < e83eed1bea142c8fe852fd53156845b88252ecd8 (git)
Affected: ae0751ffc77e7f21629970fdab5528c573e637f8 , < 872f486259ae0bc6b73ca4735a15d013241f73e9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.3
Unaffected: 0 , < 3.3 (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_error.c",
            "drivers/ufs/core/ufshcd.c",
            "include/scsi/scsi_host.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e83eed1bea142c8fe852fd53156845b88252ecd8",
              "status": "affected",
              "version": "ae0751ffc77e7f21629970fdab5528c573e637f8",
              "versionType": "git"
            },
            {
              "lessThan": "872f486259ae0bc6b73ca4735a15d013241f73e9",
              "status": "affected",
              "version": "ae0751ffc77e7f21629970fdab5528c573e637f8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/scsi_error.c",
            "drivers/ufs/core/ufshcd.c",
            "include/scsi/scsi_host.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "lessThan": "3.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: pair EH runtime PM get and put\n\nshost-\u003eeh_noresume is currently consulted twice in one error handling\niteration: once before scsi_autopm_get_host() and once again before\nscsi_autopm_put_host().\n\nThat is racy when a PM-triggered error path flips shost-\u003eeh_noresume\nwhile the SCSI EH thread is still running.\n\nThe problem flow looks like this:\nPM path\n  ufshcd_set_dev_pwr_mode()\n    shost-\u003eeh_noresume = 1\n    ufshcd_execute_start_stop  \u003c-- trigger EH\n    ...\n    shost-\u003eeh_noresume = 0\n\nEH path\n  scsi_error_handler()\n    if (!shost-\u003eeh_noresume)\n      scsi_autopm_get_host()  \u003c-- skipped\n    ...\n    if (!shost-\u003eeh_noresume)\n       scsi_autopm_put_host()  \u003c-- executed later\n\nIn that case one EH iteration can skip autoresume on entry and still\ndrop a runtime PM reference on exit. That leaves an unmatched runtime PM\nput and can trigger a runtime PM usage count underflow.\n\nFix this by making eh_noresume a regular bool so it can be accessed with\nREAD_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use\nthat snapshot for both runtime PM get and put decisions."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T14:37:00.766Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e83eed1bea142c8fe852fd53156845b88252ecd8"
        },
        {
          "url": "https://git.kernel.org/stable/c/872f486259ae0bc6b73ca4735a15d013241f73e9"
        }
      ],
      "title": "scsi: core: pair EH runtime PM get and put",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74754",
    "datePublished": "2026-08-26T14:37:00.766Z",
    "dateReserved": "2026-08-15T05:44:03.931Z",
    "dateUpdated": "2026-08-26T14:37:00.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74754",
      "date": "2026-09-01",
      "epss": "0.00155",
      "percentile": "0.04979"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74754\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:16:54.500\",\"lastModified\":\"2026-08-26T15:16:54.500\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: core: pair EH runtime PM get and put\\n\\nshost-\u003eeh_noresume is currently consulted twice in one error handling\\niteration: once before scsi_autopm_get_host() and once again before\\nscsi_autopm_put_host().\\n\\nThat is racy when a PM-triggered error path flips shost-\u003eeh_noresume\\nwhile the SCSI EH thread is still running.\\n\\nThe problem flow looks like this:\\nPM path\\n  ufshcd_set_dev_pwr_mode()\\n    shost-\u003eeh_noresume = 1\\n    ufshcd_execute_start_stop  \u003c-- trigger EH\\n    ...\\n    shost-\u003eeh_noresume = 0\\n\\nEH path\\n  scsi_error_handler()\\n    if (!shost-\u003eeh_noresume)\\n      scsi_autopm_get_host()  \u003c-- skipped\\n    ...\\n    if (!shost-\u003eeh_noresume)\\n       scsi_autopm_put_host()  \u003c-- executed later\\n\\nIn that case one EH iteration can skip autoresume on entry and still\\ndrop a runtime PM reference on exit. That leaves an unmatched runtime PM\\nput and can trigger a runtime PM usage count underflow.\\n\\nFix this by making eh_noresume a regular bool so it can be accessed with\\nREAD_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use\\nthat snapshot for both runtime PM get and put decisions.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/scsi/scsi_error.c\",\"drivers/ufs/core/ufshcd.c\",\"include/scsi/scsi_host.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ae0751ffc77e7f21629970fdab5528c573e637f8\",\"lessThan\":\"e83eed1bea142c8fe852fd53156845b88252ecd8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ae0751ffc77e7f21629970fdab5528c573e637f8\",\"lessThan\":\"872f486259ae0bc6b73ca4735a15d013241f73e9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/scsi/scsi_error.c\",\"drivers/ufs/core/ufshcd.c\",\"include/scsi/scsi_host.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/872f486259ae0bc6b73ca4735a15d013241f73e9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e83eed1bea142c8fe852fd53156845b88252ecd8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-27T06:42:40+00:00",
      "cve": "CVE-2026-74754",
      "id": "CVE-2026-74754",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: scsi: core: pair EH runtime PM get and put",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74754.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.