CVE-2026-64003: Linux Kernel SCSI Core DoS Vulnerability

CVE-2026-64003 Overview

CVE-2026-64003 is a Linux kernel vulnerability in the SCSI (Small Computer System Interface) core subsystem. The flaw resides in the scsi_run_host_queues() function, which fails to run queues for devices in partially removed states such as SDEV_CANCEL. When a SCSI host enters a recovery state, requeued commands on these devices become stuck, causing the device removal process to hang indefinitely. The issue stems from shost_for_each_device() relying on scsi_device_get() state checks that are too restrictive for the recovery path.

Critical Impact
A local condition on the SCSI stack can hang device removal and exhaust host resources, resulting in a high-impact denial of service against kernel storage operations.

Affected Products

Linux kernel (mainline) with the SCSI core subsystem
Linux stable kernel branches prior to the fix commits
Distributions shipping vulnerable kernel versions

Discovery Timeline

2026-07-19 - CVE-2026-64003 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64003

Vulnerability Analysis

The vulnerability affects the Linux kernel SCSI multi-queue (blk-mq) requeue path. When a SCSI host is in a recovery state, scsi_mq_requeue_cmd() places commands on a requeue list without scheduling them to be kicked. The kernel relies on a subsequent call to scsi_run_host_queues() to iterate all devices and resume queue processing once recovery completes.

The defect lies in the device iteration macro shost_for_each_device(), which invokes scsi_device_get() internally. That helper rejects devices in transitional states such as SDEV_CANCEL. Devices undergoing partial removal can hold requeued requests that never resume, blocking the removal path and stalling I/O completion.

This is a kernel-level Denial of Service condition triggered through legitimate storage state transitions. The condition can be reached whenever SCSI host recovery overlaps with device teardown.

Root Cause

The root cause is overly restrictive state filtering during host queue restart. scsi_run_host_queues() should only skip devices in the terminal SDEV_DEL state or those where a reference cannot be acquired. Instead, it inherits scsi_device_get() semantics that additionally exclude SDEV_CANCEL and other intermediate states, leaving requeued commands stranded.

Attack Vector

The issue manifests when SCSI error recovery races with device removal. Any workload that triggers host-level recovery while a target device is being canceled can reproduce the hang. The fix modifies queue iteration to run against all non-SDEV_DEL devices that permit reference acquisition, ensuring stuck requeue lists are drained.

No verified proof-of-concept code is available. Technical details are documented in the upstream commits referenced below, including Kernel Git Commit d4dddfec and Kernel Git Commit 7205b5b.

Detection Methods for CVE-2026-64003

Indicators of Compromise

Hung task warnings referencing SCSI removal or scsi_remove_device in kernel logs
Processes stuck in uninterruptible sleep (D state) waiting on block layer completions
Devices persisting in SDEV_CANCEL state without progressing to SDEV_DEL
I/O stalls following SCSI error handler (scsi_eh) recovery events

Detection Strategies

Monitor dmesg and /var/log/kern.log for INFO: task ... blocked for more than messages tied to SCSI or block layer functions.
Query /sys/class/scsi_device/*/device/state to identify devices lingering in non-terminal states after removal attempts.
Correlate SCSI EH recovery events with subsequent I/O latency spikes and stuck requeue lists visible under /sys/kernel/debug/block/*/hctx*/.

Monitoring Recommendations

Alert on prolonged uninterruptible task states associated with kernel storage threads.
Track kernel version inventory across Linux fleets to identify hosts running vulnerable SCSI code paths.
Capture and centralize kernel logs to detect repeated recovery-followed-by-hang patterns indicative of exploitation of this condition.

How to Mitigate CVE-2026-64003

Immediate Actions Required

Apply the upstream Linux stable kernel updates that include the SCSI core fix commits referenced by NVD.
Prioritize patching on hosts with heavy SCSI I/O, hot-plug storage, or frequent device removal workflows.
Reboot affected systems after kernel update so the corrected scsi_run_host_queues() logic is loaded.

Patch Information

The fix is available through the mainline and stable Linux kernel trees. Reference commits include Kernel Git Commit 15fb19a, Kernel Git Commit 475f2b3, Kernel Git Commit 7205b5b, Kernel Git Commit c740e13, and Kernel Git Commit d4dddfec. The change replaces the strict scsi_device_get() filter with logic that only skips devices in SDEV_DEL or those where reference acquisition fails.

Workarounds

No supported workaround exists at the source level; patching is the recommended remediation.
Reduce exposure by avoiding forced SCSI error recovery combined with concurrent device removal operations on unpatched hosts.
Where patching must be deferred, schedule storage maintenance during quiescent periods to minimize the probability of triggering the race.

bash

# Verify current kernel version and check for the SCSI fix
uname -r

# Debian / Ubuntu
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r)

# Red Hat / CentOS / Rocky
sudo dnf update kernel

# Reboot to load the patched kernel
sudo systemctl reboot