CVE-2026-74754

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> scsi: core: pair EH runtime PM get and put<br /> <br /> shost-&gt;eh_noresume is currently consulted twice in one error handling<br /> iteration: once before scsi_autopm_get_host() and once again before<br /> scsi_autopm_put_host().<br /> <br /> That is racy when a PM-triggered error path flips shost-&gt;eh_noresume<br /> while the SCSI EH thread is still running.<br /> <br /> The problem flow looks like this:<br /> PM path<br /> ufshcd_set_dev_pwr_mode()<br /> shost-&gt;eh_noresume = 1<br /> ufshcd_execute_start_stop eh_noresume = 0<br /> <br /> EH path<br /> scsi_error_handler()<br /> if (!shost-&gt;eh_noresume)<br /> scsi_autopm_get_host() eh_noresume)<br /> scsi_autopm_put_host()