Deadlock in Linux kernel libsas SMP I/O during HA resume
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Partial Red Hat: 7 without a fix
No CVSS vector from any source. Fix status from CNA and Red Hat.
Summary
In the Linux kernel SCSI libsas subsystem, a deadlock occurs during host adapter resume. An expander-attached SATA disk can trigger it because the hard reset issues an SMP command from the resume path, which waits on a runtime PM resume that is itself blocked. The affected Linux kernel ranges include 6.1.183 before 6.1.191, 6.6.151 before 6.6.161, 6.12.103 before 6.12.115, 6.18.44 before 6.18.59 and 7.1.8 before 7.2. The record does not list any known exploitation.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
Description from the CNA
In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix SMP IO deadlock during HA resume smp_execute_task_sg() calls pm_runtime_get_sync() on the host before issuing an SMP command. When that command is itself issued from the HA resume path, the get_sync() deadlocks: it waits for the ongoing resume (the device is RPM_RESUMING), while the resume is blocked in sas_drain_work() waiting for that same SMP IO to complete. The deadlock needs an expander-attached SATA disk. During sas_resume_ha() -> sas_drain_work(), DISCE_RESUME -> sas_resume_sata() -> ata_sas_port_resume() requests ATA_EH_RESET, and the hard reset for such a disk is done via SMP PHY CONTROL (sas_ata_hard_reset() -> sas_phy_reset() -> sas_smp_phy_control() -> smp_execute_task_sg()). Direct-attached SATA resets through lldd_control_phy() and SSP devices use TMFs, so neither hits this. Replace the get_sync()/put_sync() pair with pm_runtime_get_noresume()/pm_runtime_put(). smp_execute_task_sg() only needs to hold off autosuspend while the SMP is in flight, and it must not try to resume the host: a sync resume issued from the HA resume path itself is what deadlocks, and by the time sas_resume_ha() runs, hw_init has already reinitialized the hardware, so the device is accessible without one. The usage reference is still required. Discovery work normally runs inside an event worker's PM reference, taken at sas_notify_port_event() notify time and held until the handler has flushed the disco queue. sas_rediscover_ex_phy() however requeues DISCE_REVALIDATE_DOMAIN from within the revalidation worker itself, and flush_workqueue() does not wait for work items queued during execution, so that chained revalidation runs with no outer PM reference - without the get_noresume(), its SMP could race autosuspend. For the BSG path, sas_smp_handler() is the only caller which may find the host autosuspended: expander SMP requests do not go through any SCSI device request queue, so nothing else in that path holds the host awake. Resume it there with pm_runtime_resume_and_get() and check the result.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 6.1.183 to before 6.1.191; 6.6.151 to before 6.6.161; 6.12.103 to before 6.12.115; 6.18.44 to before 6.18.59; 7.1.8 to before 7.2 | 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2 | Patch available | CNA |
| Linux | Linux | 7.2 and later | 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2.13, 7.3 | Patch available | CNA |
- Linux VendorLinux Affected 6.1.183 to before 6.1.191; 6.6.151 to before 6.6.161; 6.12.103 to before 6.12.115; 6.18.44 to before 6.18.59; 7.1.8 to before 7.2 Fixed in 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2 Patch available CNA
- Linux VendorLinux Affected 7.2 and later Fixed in 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2.13, 7.3 Patch available CNA
Remediation
Upgrade the Linux kernel to 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2 or later in its branch, or to 7.2.13 or 7.3 where listed. Red Hat rates this Moderate. The sources list no fixed version for Red Hat Enterprise Linux 7, 8, 9, 10, OpenShift Container Platform 4 and 5, and no fix planned for Red Hat Enterprise Linux 6.
Written with Claude Haiku 5.5 from the sources below · 2026-11-03
- Fix · CNA Linux (Linux) Fixed in 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2
- Fix · CNA Linux (Linux) Fixed in 6.1.191, 6.6.161, 6.12.115, 6.18.59, 7.2.13, 7.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-28 Threatist record created from CVE-2026-99202
- 2026-10-28 Alias added: GHSA-pc8p-2j27-g7rj
- 2026-10-30 Fix available: Linux/[email protected], Linux/[email protected], Linux/[email protected] +3 · CNA
- 2026-10-30 3 new references · CNA
- 2026-11-02 Affected versions changed · Red Hat
- 2026-11-02 CVSS score added · Red Hat
- 2026-11-03 Affected versions changed · Red Hat
References
Other 6
- https://git.kernel.org/stable/c/ab91a558084fdb8cca4919ffb769ca4328e91bbd
- https://git.kernel.org/stable/c/6078a5369f9e8d22bb03b8890cb0bb47c91a5017
- https://git.kernel.org/stable/c/7004c18c38aaa2b87164b54dd77c320b4c63b89b
- https://git.kernel.org/stable/c/c9fb89246d9922ac0a45d504adb03e0bb971310c
- https://git.kernel.org/stable/c/08b95ef36a64c3ae4490794bed3c35d0c3354e85
- https://git.kernel.org/stable/c/81e097a064b28b4a1f6ca1a8b433e659c1bd64c0
More Linux vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
Sources
- CVE-2026-99202 · CVE Program
- CVE-2026-99202 · NVD
- FIRST EPSS
- GHSA-pc8p-2j27-g7rj · GitHub Advisory Database · CC BY 4.0
- CVE-2026-99202 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences