CVE-2026-74754 Overview
CVE-2026-74754 is a race condition in the Linux kernel SCSI core error handling (EH) subsystem. The flaw stems from an unsynchronized read of shost->eh_noresume between paired runtime power management (PM) get and put operations. When a PM-triggered error path flips shost->eh_noresume while the SCSI EH thread is still running, one EH iteration can skip scsi_autopm_get_host() on entry yet still call scsi_autopm_put_host() on exit. This creates an unmatched runtime PM reference and can trigger a runtime PM usage count underflow in the kernel.
Critical Impact
A local race between the PM path and the SCSI EH thread can corrupt the runtime PM reference count on a SCSI host, destabilizing device power management.
Affected Products
- Linux kernel SCSI core (drivers/scsi)
- Kernel builds using UFS host controller driver (ufshcd) that call ufshcd_set_dev_pwr_mode()
- Distributions shipping affected stable Linux kernel branches prior to the fix
Discovery Timeline
- 2026-08-26 - CVE-2026-74754 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-74754
Vulnerability Analysis
The SCSI error handler reads shost->eh_noresume twice within a single iteration of scsi_error_handler(). The first read gates the call to scsi_autopm_get_host(), and the second gates the paired scsi_autopm_put_host(). Because these two reads are not atomic and no lock covers both, another thread can change the flag between them.
The UFS power management path exhibits exactly this pattern. ufshcd_set_dev_pwr_mode() sets shost->eh_noresume = 1, issues ufshcd_execute_start_stop which can trigger EH, and later clears shost->eh_noresume = 0. If EH observes the flag as set on entry and cleared on exit, the get is skipped while the put still runs.
Root Cause
The root cause is a time-of-check to time-of-use (TOCTOU) race on a non-atomic field. eh_noresume was declared as a bitfield that could be modified without any memory ordering guarantee, and the SCSI EH loop consulted it independently at two distinct points. The fix converts eh_noresume to a regular bool accessed via READ_ONCE() and WRITE_ONCE(), then snapshots the value once per EH iteration so both PM decisions use the same view.
Attack Vector
This is a local kernel concurrency defect rather than a remotely reachable flaw. Triggering it requires the SCSI EH thread and a PM code path, such as UFS device power mode transitions, to interleave on the same host. The observable consequence is a runtime PM usage count underflow, which can produce PM state inconsistencies, warnings, and potential device power management failure on affected storage stacks.
See the upstream patches for the exact code changes: Kernel.org Commit Reference and Kernel.org Commit Update.
Detection Methods for CVE-2026-74754
Indicators of Compromise
- Kernel log warnings referencing runtime PM usage count underflow on SCSI or UFS hosts.
- dev_pm_qos or pm_runtime traces showing unbalanced get and put calls tied to scsi_error_handler.
- Unexpected SCSI host state transitions coincident with UFS set_dev_pwr_mode operations.
Detection Strategies
- Inventory running kernel versions against the fixed stable branches referenced in the upstream commits.
- Enable CONFIG_PM_DEBUG and monitor dmesg for PM reference counting warnings on systems with UFS storage.
- Correlate SCSI EH activity in kernel traces with concurrent PM transitions to identify vulnerable interleavings.
Monitoring Recommendations
- Ship kernel logs to a centralized logging or SIEM pipeline and alert on PM underflow strings and SCSI EH warnings.
- Track kernel package versions across Linux fleets to confirm the patched build is deployed on storage-heavy hosts.
- Watch for repeated SCSI error handler invocations on UFS-backed systems, which increase exposure to the race.
How to Mitigate CVE-2026-74754
Immediate Actions Required
- Update to a Linux kernel that includes the upstream fixes referenced in the NVD entry.
- Prioritize patching on mobile, embedded, and server platforms using UFS storage where the race is most likely to be observed.
- Reboot systems after installing the updated kernel so the corrected SCSI EH code is active.
Patch Information
The fix converts shost->eh_noresume to a bool, uses READ_ONCE() and WRITE_ONCE() for all accesses, and snapshots the value once per EH iteration to pair scsi_autopm_get_host() and scsi_autopm_put_host() consistently. Apply the changes from Kernel.org Commit Reference and Kernel.org Commit Update, or install a distribution kernel that backports them.
Workarounds
- No supported code-level workaround exists; the flaw is in core SCSI error handling logic.
- Reduce exposure by limiting workloads that stress UFS power state transitions until patched kernels are deployed.
- Where feasible, avoid running unpatched kernels on systems that combine SCSI EH activity with frequent PM transitions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
