PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-23110 Linux CVE debrief

A MEDIUM severity vulnerability, CVE-2026-23110, was found in the Linux kernel. This issue involves a race condition in the SCSI layer that can cause I/O through the SCSI host to become stuck, as the error state cannot advance. The vulnerability arises from a fragile ordering between marking commands completed or failed and waking the error handler. There are two primary race conditions: one within scsi_dec_host_busy() due to memory ordering issues, and another with scsi_eh_inc_host_failed() that can prevent the error handler from being woken. To address this, a memory barrier on the error path is necessary to ensure visibility of the write before counting host busy commands. Additionally, the call to scsi_host_busy() needs to be moved after host_failed is incremented to close the race condition. This vulnerability has been resolved with several patches applied to the Linux kernel.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-14
Original CVE updated
2026-07-28
Advisory published
2026-07-14
Advisory updated
2026-07-28

Who should care

System administrators and security professionals managing Linux kernel-based systems, especially those using kernel versions prior to the patched versions, should be aware of this vulnerability. Given its MEDIUM severity and potential impact on system stability and security, attention is required to ensure systems are updated with the appropriate patches.

Technical summary

CVE-2026-23110 is a vulnerability in the Linux kernel's SCSI layer. It involves a race condition that can prevent the error handler from waking, leading to stuck I/O operations. The issue is caused by a memory ordering problem within scsi_dec_host_busy() and a general ordering issue with scsi_eh_inc_host_failed(). These problems can result in the SCSI layer failing to advance its error state. The vulnerability has been addressed through the application of several patches to the Linux kernel, ensuring proper memory barriers and command counting to prevent these race conditions.

Defensive priority

Apply patches: Ensure the Linux kernel is updated with patches addressing the race conditions in the SCSI layer. Verify system configurations: Check system configurations and inventory to identify potentially affected systems. Monitor system logs: Monitor system logs for any signs of I/O issues or error handler failures. Implement compensating controls: Consider implementing compensating controls, such as enhanced monitoring, until patches can be applied.

Recommended defensive actions

  • Apply patches: Ensure the Linux kernel is updated with patches addressing the race conditions in the SCSI layer.
  • Verify system configurations: Check system configurations and inventory to identify potentially affected systems.
  • Monitor system logs: Monitor system logs for any signs of I/O issues or error handler failures.
  • Implement compensating controls: Consider implementing compensating controls, such as enhanced monitoring, until patches can be applied.
  • Perform vulnerability scanning: Conduct vulnerability scanning to identify systems that may be affected by this vulnerability.
  • Review system updates: Regularly review system updates and patches to ensure timely application of security fixes.

Evidence notes

The CVE record was published on 2026-02-04T17:16:21.880Z and was last modified on 2026-07-14T13:18:25.040Z. The NVD entry is currently Modified. This debrief is based on information from the CVE.org record and the NVD detail page.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-23110 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-23110

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-23110 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-23110

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/219f009ebfd1ef3970888ee9eef4c8a06357f862

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/64ae21b9c4f0c7e60cf47a53fa7ab68852079ef0

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6d9a367be356101963c249ebf10ea10b32886607

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9fdc6f28d5e81350ab1d2cac8389062bd09e61e1

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cc872e35c0df80062abc71268d690a2f749e542e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fe2f8ad6f0999db3b318359a01ee0108c703a8c3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-019113.html

    0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.