CVE-2026-23110 Overview
CVE-2026-23110 is a race condition vulnerability [CWE-362] in the Linux kernel SCSI core subsystem. The flaw resides in the ordering between marking SCSI commands as completed or failed and waking the SCSI error handler. Two distinct race conditions exist: a memory ordering issue in scsi_dec_host_busy() where the write clearing SCMD_STATE_INFLIGHT can be reordered with reads in scsi_host_busy(), and a general ordering issue in scsi_eh_inc_host_failed() where busy commands are counted before host_failed is incremented. Either race can prevent the error handler from being woken, leaving I/O through the SCSI host stuck because the error state cannot advance.
Critical Impact
A local low-privileged attacker triggering SCSI error paths can leave I/O permanently stalled, causing a denial-of-service condition on the affected host.
Affected Products
- Linux Kernel 6.19-rc1 through 6.19-rc6
- Earlier Linux kernel branches containing the SCSI core completion/error-handler code path
- Distributions shipping vulnerable kernel versions prior to the upstream fix
Discovery Timeline
- 2026-02-04 - CVE-2026-23110 published to NVD
- 2026-05-04 - Last updated in NVD database
Technical Details for CVE-2026-23110
Vulnerability Analysis
The vulnerability exists in the SCSI mid-layer command completion accounting logic. The Linux SCSI core tracks in-flight commands using the SCMD_STATE_INFLIGHT bit on each scsi_cmnd and maintains parallel counters that the error handler uses to determine whether all outstanding commands have completed or timed out. The error handler must only be woken when the last running command finishes, so the wakeup logic compares host_busy against host_failed.
When two CPUs race in the final-completion path, the unordered writes and reads across these counters allow a window where neither completion path observes the condition required to wake the error handler. The result is a permanently stuck SCSI host: commands have been marked failed, yet no thread advances the error recovery state machine.
Root Cause
The root cause is twofold. First, in scsi_dec_host_busy(), the store that clears SCMD_STATE_INFLIGHT can be reordered with the subsequent loads inside scsi_host_busy(). Remote CPUs may therefore still observe a raised busy count even though the local CPU has cleared its in-flight bit, causing the equality check between host_busy and host_failed to be missed everywhere. Second, scsi_eh_inc_host_failed() counts busy commands before incrementing host_failed, so it can race against a concurrent scsi_dec_host_busy() call. Neither side observes the state needed to issue the wakeup.
Attack Vector
Exploitation requires local access with the ability to drive SCSI I/O that triggers error paths, such as forcing command timeouts or device aborts. The attack vector is local with high attack complexity because timing the race against final completions is non-trivial. There is no impact to confidentiality or integrity, but availability of the storage subsystem is affected. No public proof-of-concept or exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
The upstream fix introduces a memory barrier on the error path to make the SCMD_STATE_INFLIGHT clear visible before counting host-busy commands, and reorders scsi_eh_inc_host_failed() so that scsi_host_busy() is called only after host_failed is incremented. See the fix commits referenced in the kernel.org stable tree for the exact diff.
Detection Methods for CVE-2026-23110
Indicators of Compromise
- SCSI host appears hung with outstanding commands that never complete or time out cleanly
- Kernel log entries showing SCSI error handler not being invoked despite command failures
- Processes blocked indefinitely in uninterruptible sleep (D state) on SCSI I/O
- dmesg output containing repeated SCSI timeout messages with no subsequent recovery actions
Detection Strategies
- Inventory kernel versions across the fleet and flag hosts running unpatched 6.19-rc series or earlier vulnerable builds
- Monitor /sys/class/scsi_host/host*/host_busy for values that remain non-zero while no I/O is progressing
- Correlate process hangs in D state with SCSI subsystem messages in journald or dmesg
- Use kernel tracepoints under scsi: to capture command completion versus error-handler wakeup events
Monitoring Recommendations
- Alert on processes stuck in uninterruptible sleep for longer than operational thresholds, especially storage-facing workloads
- Track SCSI error handler invocation counts and compare against command timeout counts
- Enable kernel soft lockup and hung task detection (kernel.hung_task_timeout_secs) to surface stalls
How to Mitigate CVE-2026-23110
Immediate Actions Required
- Identify all Linux systems running affected kernel versions, prioritizing storage servers and virtualization hosts
- Apply the stable kernel update containing the SCSI core fix from your distribution vendor as soon as it is available
- Schedule reboots for systems where live patching is not available, since the change affects core SCSI mid-layer code paths
Patch Information
The fix is committed to the upstream Linux kernel stable tree. Relevant commits include 219f009e, 64ae21b9, 6d9a367b, 9fdc6f28, cc872e35, and fe2f8ad6. Review the full commit set at the Linux stable tree and apply the backport corresponding to your kernel branch. Distribution vendors typically ship the fix as part of their next kernel security update.
Workarounds
- No documented configuration-level workaround exists because the issue is in core SCSI mid-layer synchronization
- Limit local access on multi-tenant systems to reduce exposure until patches are deployed
- Where feasible, reduce reliance on SCSI error injection or aggressive timeout tuning that could increase the likelihood of triggering the race
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
