SCSI Command Handling Issue in Linux Kernel Affecting Multiple Devices

CVE-2026-64003

What is CVE-2026-64003?

A SCSI command handling issue in the Linux kernel may lead to requests being stuck when devices are in a recovery state. Specifically, the function scsi_run_host_queues() fails to consider partially removed devices, such as those with a SDEV_CANCEL state, leading to a situation where requeued commands are not processed as expected. This could significantly hinder device removal processes and impact overall system performance. To mitigate this issue, it is necessary for scsi_run_host_queues() to attempt to manage queues for all devices, while only excluding those in a SDEV_DEL state.

References