The vulnerability arises because the SCSI error handler calls scsi_eh_lock_door(), which allocates a request without the NONBLOCK flag while the host is still in recovery. When all command tags are occupied by requeued commands, the allocation blocks, creating a circular wait. The error handler then cannot finish restarting the SCSI queues, and the blocked commands can never complete. This results in a deadlock that prevents any I/O from the affected device, causing a denial of service for that device and potentially for the entire system if the lock is critical.

All Linux kernel builds that include the original scsi_eh_lock_door() implementation. Devices that use a single SCSI tag per driver, such as USB storage devices, are guaranteed deadlock. Kernels older than the upstream patch commit (for example, the one referenced at https://git.kernel.org/stable/c/261c80a6b23e34ba98bcf3f75317e35ecf0a08f0) are affected.

No EPSS data or KEV listing are available, indicating no known exploits or cataloguing. The issue only manifests during SCSI error recovery and requires a failure condition of the SCSI host. Because it is a local, kernel‑level deadlock, the likelihood of exploitation is low, but the impact on availability is high should the scenario occur. The circular dependency describing the lock and retry logic forms the root cause.