CVE-2026-98478: scsi: ufs: core: Keep internal commands dispatchable during error handling
In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Keep internal commands dispatchable during error handling
Commit 08b12cda6c44 ("scsi: ufs: core: Switch to scsigetinternalcmd()") switched UFS internal commands to allocate requests on hba->host->pseudosdev->requestqueue, which shares the host tagset with regular LUNs.
During error recovery, ufshcderrhandlingprepare() calls blkmqquiescetagset(&hba->host->tagset), marking all queues in the tagset as quiesced, including pseudosdev->requestqueue. When ufshcdverifydevinit() subsequently issues internal commands (e.g. NOP OUT UPIU) via blkexecuterq(), blkmqrunhwqueue() skips running the quiesced queue, resulting in an unrecoverable circular wait deadlock.
Keep quiescing the tagset and unquiesce the pseudo SCSI device on top of that, so internal commands stay dispatchable while the logical units remain quiesced. Re-quiesce the pseudo device before unquiescing the tagset so that quiescedepth stays balanced.
Clock scaling and ufshcdpausecommandprocessing() are unaffected: they keep quiescing the whole tagset, internal commands included.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 08b12cda6c44
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel UFS driver are exposed when UFS error recovery runs. The deadlock involves the UFS host tagset, regular logical-unit queues, and the pseudo SCSI device queue used for internal UFS commands.
What condition triggers the failure?
The failure occurs during UFS error recovery after the host tagset is quiesced and device initialization verification then sends an internal command such as NOP OUT UPIU. Because the pseudo SCSI device queue is also quiesced, the internal command cannot be dispatched, producing a circular wait deadlock.
Are clock scaling or paused command processing affected?
No. Clock scaling and ufshcd_pause_command_processing() intentionally continue to quiesce the entire tagset, including internal commands, and are identified as unaffected.