CVE-2026-74754 - Vulnerability Details

- scsi: core: pair EH runtime PM get and put

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: pair EH runtime PM get and put

shost->eh_noresume is currently consulted twice in one error handling
iteration: once before scsi_autopm_get_host() and once again before
scsi_autopm_put_host().

That is racy when a PM-triggered error path flips shost->eh_noresume
while the SCSI EH thread is still running.

The problem flow looks like this:
PM path
ufshcd_set_dev_pwr_mode()
shost->eh_noresume = 1
ufshcd_execute_start_stop <-- trigger EH
...
shost->eh_noresume = 0

EH path
scsi_error_handler()
if (!shost->eh_noresume)
scsi_autopm_get_host() <-- skipped
...
if (!shost->eh_noresume)
scsi_autopm_put_host() <-- executed later

In that case one EH iteration can skip autoresume on entry and still
drop a runtime PM reference on exit. That leaves an unmatched runtime PM
put and can trigger a runtime PM usage count underflow.

Fix this by making eh_noresume a regular bool so it can be accessed with
READ_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use
that snapshot for both runtime PM get and put decisions.

Published: 2026-08-26

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition arises when the power management path sets shost->eh_noresume while a SCSI error handler iterates, causing the error handler to skip a runtime PM get and later release a runtime PM reference. This leaves an unmatched put, resulting in a Runtime PM usage count underflow. The description does not state that this will definitely trigger kernel instability, but such an underflow could potentially compromise kernel integrity.

Affected Systems

The flaw exists in the Linux kernel's SCSI core modules in all supported releases that contain the relevant code path. The vendor listed is Linux:Linux, so any running kernel that includes this logic is potentially impacted.

Risk and Exploitability

The CVSS score is 5.5, indicating moderate severity. The EPSS score is less than 1%, suggesting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector would involve triggering the race condition by manipulating SCSI error handling or power state changes, but this is inferred and not explicitly detailed in the provided data. No public exploit is mentioned.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ae0751ffc77e7f21629970fdab5528c573e637f8`	affected	< e83eed1bea142c8fe852fd53156845b88252ecd8
`ae0751ffc77e7f21629970fdab5528c573e637f8`	affected	< 872f486259ae0bc6b73ca4735a15d013241f73e9

Linux

affected

Version	Status	Constraints
`3.3`	affected	—
`0`	unaffected	< 3.3
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ae0751ffc77e7f21629970fdab5528c573e637f8,e83eed1bea142c8fe852fd53156845b88252ecd8)`	affected	code_commit	—
`[ae0751ffc77e7f21629970fdab5528c573e637f8,872f486259ae0bc6b73ca4735a15d013241f73e9)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.3`	affected	generic	—
`[0,3.3)`	unaffected	generic	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that applies the fixed logic and uses READ_ONCE()/WRITE_ONCE() for shost->eh_noresume.
If an updated kernel is unavailable, apply the upstream patch that changes shost->eh_noresume to a regular boolean and snapshots it per EH iteration before the get and put checks.
After updating or patching, monitor system logs for warnings or kernel panics that may indicate runtime PM usage count underflow.

Generated by OpenCVE AI on August 28, 2026 at 16:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00155.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/872f486259ae0bc6b73ca4735a15d013241f73e9
https://git.kernel.org/stable/c/e83eed1bea142c8fe852fd53156845b88252ecd8
https://lore.kernel.org/linux-cve-announce/2026082600-CVE-2026-74754-2bb1@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74754
https://www.cve.org/CVERecord?id=CVE-2026-74754

History

Fri, 28 Aug 2026 08:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665

Thu, 27 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026082600-CVE-2026-74754-2bb1@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74754 https://www.cve.org/CVERecord?id=CVE-2026-74754
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Wed, 26 Aug 2026 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Wed, 26 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: scsi: core: pair EH runtime PM get and put shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host(). That is racy when a PM-triggered error path flips shost->eh_noresume while the SCSI EH thread is still running. The problem flow looks like this: PM path ufshcd_set_dev_pwr_mode() shost->eh_noresume = 1 ufshcd_execute_start_stop <-- trigger EH ... shost->eh_noresume = 0 EH path scsi_error_handler() if (!shost->eh_noresume) scsi_autopm_get_host() <-- skipped ... if (!shost->eh_noresume) scsi_autopm_put_host() <-- executed later In that case one EH iteration can skip autoresume on entry and still drop a runtime PM reference on exit. That leaves an unmatched runtime PM put and can trigger a runtime PM usage count underflow. Fix this by making eh_noresume a regular bool so it can be accessed with READ_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use that snapshot for both runtime PM get and put decisions.
Title		scsi: core: pair EH runtime PM get and put
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/872f486259ae0bc6b73ca4735a15d013241f73e9 https://git.kernel.org/stable/c/e83eed1bea142c8fe852fd53156845b88252ecd8

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-26T14:37:00.766Z

Updated: 2026-08-26T14:37:00.766Z

Reserved: 2026-08-15T05:44:03.931Z

Link: CVE-2026-74754

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-26T15:16:54.500

Modified: 2026-08-26T15:16:54.500

Link: CVE-2026-74754

Redhat

Severity : Low

Publid Date: 2026-08-26T00:00:00Z

Links: CVE-2026-74754 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-28T16:30:17Z

Weaknesses

CWE-911
Improper Update of Reference Count

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object