AUGUST 22, 2026
Live Feed
Back to database
Case File

CVE-2026-68396

UNKNOWN · CVSS N/A EPSS 0.20%

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-22

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's SCSI subsystem, specifically the error handling mechanism when using the `scsi_schedule_eh` function. If exploited, this flaw can lead to the error handler thread failing to wake up, potentially resulting in unhandled SCSI errors and degraded system performance. Organizations utilizing Linux systems with SCSI drivers should prioritize addressing this issue to ensure reliable error recovery and maintain system stability.

CVE
CVE-2026-68396
Severity
UNKNOWN
CVSS
N/A
EPSS
0.20%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: scsi: core: wake eh reliably when using scsi_schedule_eh Drivers which use the scsi_schedule_eh function to run the error handler currently risk the error handler thread never waking once all commands are timed out or inactive. There is no enforced memory order between setting the host into error recovery state and counting busy commands. This can result in a race with scsi_dec_host_busy where neither CPU sees both conditions of all commands inactive and the host error state to request waking the error handler. To fix this, run the scsi_schedule_eh's scsi_eh_wakeup from a new work item which will use rcu to ensure scsi_schedule_eh's call to scsi_host_busy will occur after the error state is globally visible and will be seen by any current scsi_dec_host_busy callers.