Description
In the Linux kernel, the following vulnerability has been resolved:

scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit

mpi3mr_fault_uevent_emit() runs from the fault watchdog and reset paths
where host I/O may already be blocked. GFP_KERNEL allocations here, both
the local kzalloc_obj() and the ones inside kobject_uevent_env() itself,
can trigger reclaim that waits on that blocked I/O and deadlock.

Use memalloc_noio_save()/restore() to cover the whole call instead of
just the local allocation.
Published: 2026-08-15
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is located in the Linux kernel's SCSI mpi3mr driver, where the mpi3mr_fault_uevent_emit function can deadlock when it performs GFP_KERNEL memory allocations while host I/O is already blocked. The memory reclaim process may wait on that blocked I/O, causing a system-wide hang and eliminating availability.

Affected Systems

Any Linux kernel installation that contains the mpi3mr driver and has not yet incorporated the fix is affected. The specific impacted versions are not listed, but the vulnerability applies to kernels before the commit that added memalloc_noio_save/restore around the function.

Risk and Exploitability

Exploit data is not available; the EPSS score is < 1% and the vulnerability is not listed in CISA's KEV catalog. The CVSS score is 5.5. Because a deadlock can halt kernel I/O, the potential impact is high. The likely attack vector is an event that triggers the fault watchdog or a reset path, possibly originating from a device fault; exploitation may require local conditions, but could be leveraged by a compromised system be it through a buggy device or intentional fault injection.

Generated by OpenCVE AI on August 21, 2026 at 22:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the kernel to a version that includes the patch that wraps mpi3mr_fault_uevent_emit with memalloc_noio_save/restore. The patch can be obtained from the referenced git commits or by installing a kernel release that incorporates it.
  • If an immediate update is not possible, apply the patch manually to the kernel source, rebuild, and install the updated kernel, ensuring the mpi3mr driver is loaded.
  • Monitor system logs for SCSI fault watchdog messages and verify that no I/O latency or blocked I/O conditions persist; consider disabling or isolating SCSI devices that trigger frequent faults during a transition period.

Generated by OpenCVE AI on August 21, 2026 at 22:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 21 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-667

Thu, 20 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-833
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Low

Sat, 15 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-667

Sat, 15 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit mpi3mr_fault_uevent_emit() runs from the fault watchdog and reset paths where host I/O may already be blocked. GFP_KERNEL allocations here, both the local kzalloc_obj() and the ones inside kobject_uevent_env() itself, can trigger reclaim that waits on that blocked I/O and deadlock. Use memalloc_noio_save()/restore() to cover the whole call instead of just the local allocation.
Title scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-17T05:21:09.281Z

Reserved: 2026-08-15T05:44:03.911Z

Link: CVE-2026-74526

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T13:17:57.883

Modified: 2026-08-17T06:19:49.460

Link: CVE-2026-74526

cve-icon Redhat

Severity : Low

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74526 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T23:00:14Z

Weaknesses