UBUNTU-CVE-2026-74754: Low severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: core: pair EH runtime PM get and put shost->ehnoresume is currently consulted twice in one error handling iteration: once before scsiautopmgethost() and once again before scsiautopmputhost(). That is racy when a PM-triggered error path flips shost->ehnoresume while the SCSI EH thread is still running. The problem flow looks like this: PM path ufshcdsetdevpwrmode() shost->ehnoresume = 1 ufshcdexecutestartstop <-- trigger EH ... shost->ehnoresume = 0 EH path scsierrorhandler() if (!shost->ehnoresume) scsiautopmgethost() <-- skipped ... if (!shost->ehnoresume) scsiautopmputhost() <-- executed later In that case one EH iteration can skip autoresume on entry and still drop a runtime PM reference on exit. That leaves an unmatched runtime PM put and can trigger a runtime PM usage count underflow. Fix this by making ehnoresume a regular bool so it can be accessed with READONCE() and WRITEONCE(). Snapshot it once per EH iteration and use that snapshot for both runtime PM get and put decisions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Make shost->eh_noresume a regular bool, snapshot it once per error-handling iteration, and use that snapshot for both scsi_autopm_get_host() and scsi_autopm_put_host() decisions.
Linux kernel SCSI core shost->eh_noresume = regular bool accessed with READ_ONCE() and WRITE_ONCE()
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The issue requires a race between the SCSI error-handling thread and a power-management-triggered error path that changes shost->eh_noresume during the same error-handling iteration. The race can cause an unmatched runtime PM put after autoresume was skipped.
What is the practical impact if the race is triggered?
An unmatched runtime PM put can cause a runtime PM usage-count underflow. The provided information does not describe a remote attack vector, privilege requirement, or impact beyond that runtime PM accounting failure.
Which Ubuntu kernel packages are listed as affected?
The listed software includes ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-gcp, and ubuntu/linux-gcp-fips.