UBUNTU-CVE-2026-98478: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 ("scsi: ufs: core: Switch to scsigetinternalcmd()") switched UFS internal commands to allocate requests on hba->host->pseudosdev->requestqueue, which shares the host tagset with regular LUNs. During error recovery, ufshcderrhandlingprepare() calls blkmqquiescetagset(&hba->host->tagset), marking all queues in the tagset as quiesced, including pseudosdev->requestqueue. When ufshcdverifydevinit() subsequently issues internal commands (e.g. NOP OUT UPIU) via blkexecuterq(), blkmqrunhwqueue() skips running the quiesced queue, resulting in an unrecoverable circular wait deadlock. Keep quiescing the tagset and unquiesce the pseudo SCSI device on top of that, so internal commands stay dispatchable while the logical units remain quiesced. Re-quiesce the pseudo device before unquiescing the tagset so that quiescedepth stays balanced. Clock scaling and ufshcdpausecommandprocessing() are unaffected: they keep quiescing the whole tagset, internal commands included.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
The issue applies to the listed Ubuntu Linux kernel packages when they are used with UFS storage hardware. The deadlock occurs in the UFS driver's error-recovery path, rather than during normal command processing.
What condition triggers the deadlock?
An error-recovery sequence must quiesce the host tag set and then issue UFS internal commands, such as NOP OUT UPIU commands, during device initialization verification. Because the pseudo SCSI device queue is also quiesced, those internal commands cannot be dispatched and recovery can enter a circular wait.
Are all UFS command-quiescing paths affected?
No. Clock scaling and ufshcd_pause_command_processing() are described as unaffected because they continue to quiesce the entire tag set, including internal commands.
How can an administrator recognize a potentially affected event?
Affected systems can become stuck in UFS error recovery when internal commands issued by ufshcd_verify_dev_init() do not run after the host tag set has been quiesced. The provided data does not specify a particular log message or other definitive detection indicator.