CVE-2026-98478: scsi: ufs: core: Keep internal commands dispatchable during error handling

Published Oct 18, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Keep internal commands dispatchable during error handling

Commit 08b12cda6c44 ("scsi: ufs: core: Switch to scsigetinternalcmd()") switched UFS internal commands to allocate requests on hba->host->pseudosdev->requestqueue, which shares the host tagset with regular LUNs.

During error recovery, ufshcderrhandlingprepare() calls blkmqquiescetagset(&hba->host->tagset), marking all queues in the tagset as quiesced, including pseudosdev->requestqueue. When ufshcdverifydevinit() subsequently issues internal commands (e.g. NOP OUT UPIU) via blkexecuterq(), blkmqrunhwqueue() skips running the quiesced queue, resulting in an unrecoverable circular wait deadlock.

Keep quiescing the tagset and unquiesce the pseudo SCSI device on top of that, so internal commands stay dispatchable while the logical units remain quiesced. Re-quiesce the pseudo device before unquiescing the tagset so that quiescedepth stays balanced.

Clock scaling and ufshcdpausecommandprocessing() are unaffected: they keep quiescing the whole tagset, internal commands included.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 18, 2026

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

Description

Data Sourced

via NVD·04:16 PM

Description

Frequently Asked Questions

What systems are exposed to this issue?

Systems using the Linux kernel UFS driver are exposed when UFS error recovery runs. The deadlock involves the UFS host tagset, regular logical-unit queues, and the pseudo SCSI device queue used for internal UFS commands.

What condition triggers the failure?

The failure occurs during UFS error recovery after the host tagset is quiesced and device initialization verification then sends an internal command such as NOP OUT UPIU. Because the pseudo SCSI device queue is also quiesced, the internal command cannot be dispatched, producing a circular wait deadlock.

Are clock scaling or paused command processing affected?

No. Clock scaling and ufshcd_pause_command_processing() intentionally continue to quiesce the entire tagset, including internal commands, and are identified as unaffected.

CVE-2026-98478: scsi: ufs: core: Keep internal commands dispatchable during error handling

Affected Software

Event History

Frequently Asked Questions

What systems are exposed to this issue?

What condition triggers the failure?

Are clock scaling or paused command processing affected?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to this issue?

What condition triggers the failure?

Are clock scaling or paused command processing affected?