CVE-2026-93781 Linux CVE debrief

Who should care

Linux system administrators, security teams, and developers working with Linux kernel-based systems should assess their exposure to this vulnerability and prioritize verification and patching of affected systems.

Why it matters

Linux system administrators and security teams should assess exposure and prioritize verification of affected systems, especially those with single driver tags like USB storage, to prevent potential I/O deadlocks and other operational impacts.

• Potential I/O deadlocks and prevention of I/O submission
• Increased risk of system hangs or freezes
• Need for verification of Linux kernel versions and configurations
• Priority for applying patches or updates provided by Linux kernel maintainers

Technical summary

The Linux kernel vulnerability causes a circular dependency in SCSI error handling. When the SCSI error handler thread is called, it attempts to allocate a request via scsi_alloc_request() with no flags. This can lead to blk_mq_get_tag() blocking and waiting for a free sched tag when all tags are already in use. Those tags can be held by commands requeued by scsi_eh_flush_done_q() during error handling. Such commands cannot be dispatched until the host leaves SHOST_RECOVERY and scsi_run_host_queues() is called, which only happens after scsi_eh_lock_door() returns.

Defensive priority

Linux system administrators and security teams should assess exposure and prioritize verification of affected systems, especially those with single driver tags like USB storage, to prevent potential I/O deadlocks.

Recommended defensive actions

• Review Linux kernel versions and configurations for potential exposure
• Verify system logs for signs of SCSI error handling issues
• Apply patches or updates provided by the Linux kernel maintainers
• Monitor system performance and I/O operations for potential deadlocks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the Linux kernel vulnerability, including its description and references to source code changes. The issue is caused by a circular dependency in SCSI error handling. The error handler thread waits for a sched tag held by a requeued command, which cannot complete until the error handler thread restarts the queues. This problem can cause potential I/O deadlocks and prevention of I/O submission. Linux system administrators and security teams should assess exposure and prioritize

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.