CVE-2026-64003 Linux CVE debrief

Who should care

Linux kernel maintainers, SCSI device developers, and Linux distribution vendors should be aware of this vulnerability and its potential impact on SCSI device removal and request handling. System administrators responsible for managing Linux-based systems, especially those utilizing SCSI devices, should also be informed about this vulnerability to ensure timely patching or mitigation. Additionally, security teams and vulnerability management professionals should prioritize this vulnerability for review and potential remediation based on the organization's specific environment and risk profile.

Technical summary

The Linux kernel vulnerability CVE-2026-64003 is related to the SCSI core. Specifically, the function scsi_run_host_queues() does not run queues for all non-SDEV_DEL devices from scsi_run_host_queues(). This can cause issues when a SCSI host is in a recovery state and scsi_mq_requeue_cmd() does not set the requeue list for requeued commands. As a result, requests may become stuck and the device removal process may hang. The solution involves adjusting scsi_run_host_queues() to run against a broader range of devices, excluding only those in the SDEV_DEL state or for which a reference cannot be acquired. This adjustment ensures that requeued requests are properly handled, preventing device removal processes from hanging indefinitely.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to ensure scsi_run_host_queues() runs against the correct set of devices.
• Monitor Linux kernel updates and SCSI device handling changes for potential related vulnerabilities.
• Verify SCSI device removal and request handling in Linux kernel configurations.
• Perform a thorough review of the Linux kernel source code related to SCSI device handling to identify potential similar vulnerabilities.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis of Linux kernel source code and SCSI device handling may be necessary to fully understand the issue and its implications. The vulnerability highlights the importance of thorough testing and validation of SCSI device handling in Linux kernel configurations. Defenders should verify the presence of affected systems in their environments and prioritize patching or mitigation efforts accordingly. Evidence of exploitation or related attacks has not been reported; however, proactive measures are recommended to prevent potential disruptions.

Official resources