CVE-2026-43475: Linux Kernel Race Condition Vulnerability

CVE-2026-43475 Overview

CVE-2026-43475 is a Linux kernel vulnerability in the Hyper-V SCSI storage driver (hv_storvsc). The flaw causes a "scheduling while atomic" condition and system lock-up when PREEMPT_RT is enabled. The issue triggers inside storvsc_queuecommand, where preemption is disabled before hv_ringbuffer_write acquires a sleeping spinlock through rt_spin_lock. On real-time kernels running as Hyper-V guests, this produces a kernel BUG and stalls I/O processing.

Critical Impact
Linux real-time kernels running under Microsoft Hyper-V can deadlock during SCSI I/O, producing a denial-of-service condition for storage operations on affected virtual machines.

Affected Products

Linux kernel builds with PREEMPT_RT enabled
Hyper-V guest VMs using the hv_storvsc SCSI driver
Kernel branches referenced by the upstream stable fixes (multiple stable trees through 6.19.0-rc7)

Discovery Timeline

2026-05-08 - CVE CVE-2026-43475 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-43475

Vulnerability Analysis

The vulnerability is a locking and preemption defect [CWE-667-class] in the Hyper-V storage virtual SCSI driver. On standard kernels, storvsc_queuecommand can safely disable preemption before issuing a VMBus packet. On PREEMPT_RT kernels, however, spinlocks used inside hv_ringbuffer_write are converted into sleeping rt_spin_lock primitives. Acquiring a sleeping lock while preemption is disabled triggers the scheduler BUG visible in the reported call trace, followed by a lock-up of the SCSI submission path.

The stack trace shows the path: storvsc_queuecommand → vmbus_sendpacket_mpb_desc → hv_ringbuffer_write → rt_spin_lock → rtlock_slowlock_locked → schedule_rtlock. The scheduler is invoked from an atomic context, which is not permitted.

Root Cause

The root cause is an incompatible assumption between the storvsc driver and the PREEMPT_RT locking model. The driver disabled preemption around a region that ultimately calls into the VMBus ring buffer write path. Under PREEMPT_RT, that path may block on a converted spinlock, violating the atomic-context contract.

Attack Vector

The condition is reachable through normal storage I/O activity on a Hyper-V guest running a PREEMPT_RT kernel. The reporter reproduced it with the stress-ng-iomix workload generating concurrent block I/O against an ext4 filesystem. No authentication boundary is crossed; the impact is availability of the affected guest. There is no public exploit and EPSS scoring is low at 0.032%.

The vulnerability manifests in the I/O submission path of hv_storvsc. See the upstream commits referenced in the patch information section for technical details of the fix.

Detection Methods for CVE-2026-43475

Indicators of Compromise

Kernel log entries containing BUG: scheduling while atomic referencing storvsc_queuecommand or hv_storvsc.
Soft lock-up or stalled task warnings tied to the SCSI submission path under PREEMPT_RT.
Hyper-V guest VMs reporting I/O hangs against ext4 or other filesystems backed by hv_storvsc.

Detection Strategies

Monitor dmesg and journalctl -k for scheduling while atomic together with storvsc or hv_ringbuffer_write frames.
Correlate kernel BUG events with SCSI queue stalls and rising block-device latency metrics.
Inventory Hyper-V guests by kernel build to flag images compiled with CONFIG_PREEMPT_RT=y running unpatched hv_storvsc.

Monitoring Recommendations

Forward kernel ring buffer logs from Linux Hyper-V guests to a centralized log platform and alert on scheduling while atomic strings.
Track storage I/O completion latency and queue depth on affected hosts to catch lock-up conditions early.
Audit kernel package versions across the fleet to confirm presence of the upstream stable fixes.

How to Mitigate CVE-2026-43475

Immediate Actions Required

Apply the upstream stable kernel update that includes the storvsc PREEMPT_RT fix to all affected Hyper-V guests.
Identify any production workloads running PREEMPT_RT kernels on Hyper-V and schedule reboots after patch deployment.
Snapshot critical VMs prior to kernel updates to enable rollback if regressions occur.

Patch Information

Upstream fixes are available in the Linux stable trees. Refer to the following commits:

Workarounds

Run a non-PREEMPT_RT kernel on Hyper-V guests until the patched kernel is deployed.
Avoid heavy concurrent block I/O workloads on unpatched real-time guests to reduce reproduction likelihood.
Where real-time semantics are not required, rebuild kernels with CONFIG_PREEMPT_RT disabled as a temporary measure.

bash

# Verify running kernel and PREEMPT_RT status before and after patching
uname -a
grep PREEMPT /boot/config-$(uname -r)
dmesg | grep -i "scheduling while atomic"