From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5E093BA23F for ; Wed, 26 Aug 2026 14:37:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787755080; cv=none; b=psEjpzB7QVBiNZDhpLfv3roSgmJP7uz5zGG9PGlOL2ih4EMhcZ1zorKbutVpC45/pF/rifG2YnWr2nnW0WBkCwWqJZrsRzg9L5V+IUK1m203pF4TfVdQOJILnvaozONVvLxplw85ScN4Y34GfQ5PkTQkJPLIYmzDFUzWLokxALY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787755080; c=relaxed/simple; bh=MAdirF/LIfKzvJGbccKOGvvRRrNTDA1k9/OawtgfVfc=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=sWnu7ZroEqZx8+/6kAqR3wKxfhXTieKhXAPTiUIX779q5zkHplj/FmeR6XX+iydxFMcLCYTYCSS9iBU+zQZoQrDtcH8EZvYx3IpZ4hm/O8pNDVHaxNgWczFHeLb95NNI7oSYtvgGo+AmmMEcwiCP1JU0LxyjZkef1/A1XzrfLqM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=c3Q2XRPr; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="c3Q2XRPr" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 603BA1F000E9; Wed, 26 Aug 2026 14:37:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787755078; bh=DHXTOD95KpnoiNO6pFO3E8vKotqERPOftkTKIoHwzg8=; h=From:To:Cc:Subject:Date:Reply-To; b=c3Q2XRPrOdW5V0u09pGXkCypv+OHGk2td4UGLBabtZ2WqCIXWZCdodZ4F4shozgq+ mXedbygXdfkr7iHyj6+cTCAAzU4iKe/elFwOm8ELRKwVVEsHRz/dPyfZui8s/Ohyxa kLwex+B88SPEj+zJ2o7JrgNPMs5h4uudLA8KJL3c= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74754: scsi: core: pair EH runtime PM get and put Date: Wed, 26 Aug 2026 16:37:14 +0200 Message-ID: <2026082600-CVE-2026-74754-2bb1@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2877; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=TA+hv/H1DT/X8jAYFNS5mlwvMn1IwgJRWTw7dxWQMHE=; b=kA0DAAIRMUfUDdst+ykByyZiAGqO+gygOTy+f4Z8Ft07H5vHtoi5p4b/EXTRRdHEadoCl2jtc IhdBAARAgAdFiEE9LYMxb94wiFKMT3LMUfUDdst+ykFAmqO+gwACgkQMUfUDdst+ykW4wCeLuGm Fk3easwSMhu64KkYdwPIdZ0An1s+rX+qvB/vVjZKIiZyPIJzVdAr X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: scsi: core: pair EH runtime PM get and put shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host(). That is racy when a PM-triggered error path flips shost->eh_noresume while the SCSI EH thread is still running. The problem flow looks like this: PM path ufshcd_set_dev_pwr_mode() shost->eh_noresume = 1 ufshcd_execute_start_stop <-- trigger EH ... shost->eh_noresume = 0 EH path scsi_error_handler() if (!shost->eh_noresume) scsi_autopm_get_host() <-- skipped ... if (!shost->eh_noresume) scsi_autopm_put_host() <-- executed later In that case one EH iteration can skip autoresume on entry and still drop a runtime PM reference on exit. That leaves an unmatched runtime PM put and can trigger a runtime PM usage count underflow. Fix this by making eh_noresume a regular bool so it can be accessed with READ_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use that snapshot for both runtime PM get and put decisions. The Linux kernel CVE team has assigned CVE-2026-74754 to this issue. Affected and fixed versions =========================== Issue introduced in 3.3 with commit ae0751ffc77e7f21629970fdab5528c573e637f8 and fixed in 7.1.10 with commit e83eed1bea142c8fe852fd53156845b88252ecd8 Issue introduced in 3.3 with commit ae0751ffc77e7f21629970fdab5528c573e637f8 and fixed in 7.2 with commit 872f486259ae0bc6b73ca4735a15d013241f73e9 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74754 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/scsi/scsi_error.c drivers/ufs/core/ufshcd.c include/scsi/scsi_host.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/e83eed1bea142c8fe852fd53156845b88252ecd8 https://git.kernel.org/stable/c/872f486259ae0bc6b73ca4735a15d013241f73e9