CVE-2026-64003: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues
In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Run queues for all non-SDEVDEL devices from scsirunhostqueues
While a SCSI host is in a recovery state, scsimqrequeuecmd() will not set the requeue list for a requeued command to be kicked in the future. The expectation is a call to scsirunhostqueues() will kick all SCSI devices once the recovery state is cleared.
However, scsirunhostqueues() uses shostforeachdevice() which uses scsideviceget() and so will ignore devices in a partially removed state like SDEVCANCEL. But these devices may also have requeued requests, leaving their requests stuck from not being kicked and causing the removal process of the device to hang.
scsirunhostqueues() needs to run against more devices than the macro shostforeachdevice() allows. Instead of using the too limiting scsideviceget() state checks, only ignore devices in SDEVDEL state or when unable to acquire a reference. Attempt to run the queues for all other devices when scsirunhostqueues() is called.
Affected Software
Remediation
Event History
Frequently Asked Questions
What conditions are associated with the failure?
The issue occurs when a SCSI host is in recovery and commands are requeued. If a device is partially removed in the SDEV_CANCEL state, its requeued requests may not be run after recovery clears.
What is the operational impact?
Requeued requests can remain stuck, which can cause the affected SCSI device's removal process to hang. The described impact is availability-related; the supplied vector lists no confidentiality or integrity impact.
Which device states are relevant during queue recovery?
Devices in SDEV_CANCEL can have requeued requests and need their queues run. Devices in SDEV_DEL are intentionally excluded, as are devices for which a reference cannot be acquired.
How can I identify a possible occurrence?
Investigate SCSI device removals that hang after host recovery, particularly where requests were requeued while the host was recovering. The condition described is stuck requeued requests on a partially removed device.
What remediation is available?
A patch is available. The fix changes host queue handling to attempt queue runs for devices other than those in SDEV_DEL, rather than excluding partially removed devices through the prior state checks.