Linux kernel SCSI core: requeued commands never kicked, hanging device removal after host recovery

Impact

While a SCSI host is in recovery, scsi_mq_requeue_cmd() leaves requeued commands waiting for scsi_run_host_queues() to restart them, but that function iterates only devices scsi_device_get() accepts and so skips devices in partially removed states such as SDEV_CANCEL. Those devices keep requeued requests that are never dispatched, and the removal path hangs. On a GPU node this shows up as a wedged local NVMe/SAS disk or a stuck hot-unplug that holds the node in a half-removed state; a node you cannot cleanly remove a device from is a node you drain and reboot, and draining a GPU host means evicting every tenant job on it. The fix changes the iteration to skip only SDEV_DEL devices or those whose reference cannot be taken. No exploit path from a tenant workload is described in the record - the trigger is SCSI error recovery coinciding with device teardown.

Who can reach it

Not remotely reachable as described. Requires SCSI host error recovery to overlap with device removal, i.e. a local or hardware-triggered condition on the storage path; no authentication story is given in the record. The NVD CVSS vector marks it network-reachable with availability impact only, which overstates the practical exposure on a headless server.

What to do

Pick up the stable kernel containing the fix (five stable branches carry it - see the git.kernel.org links) and reboot each affected host. There is no runtime mitigation and no module to reload: the change is in the SCSI core. Schedule it with other kernel maintenance rather than on its own, given the trigger requires error recovery during device teardown.

References

Related entries

• Linux kernel nvme-pci: dma_vec allocations leak on every peer-to-peer I/O completionCVE-2026-64020 · Linux kernel nvme-pci (dma_vec tracking for peer-to-peer DMA)High
• Linux kernel SMC-D client (CHID matching against unpopulated ism_dev slot): Slot 0 of the client's ISM device array isCVE-2026-64048 · Linux kernel SMC-D client (CHID matching against unpopulated ism_dev slot)High
• Linux kernel pcrypt: padata fallback leaves the parallel completion callback on the child requestCVE-2026-64312 · Linux kernel crypto pcrypt (padata -EBUSY fallback path)High
• Linux kernel RT scheduler: RT_PUSH_IPI can livelock a busy many-core node under softirq loadCVE-2026-64374 · Linux kernel RT scheduler (RT_PUSH_IPI pull logic on non-PREEMPT_RT kernels)High
• Linux kernel libceph: a monmap advertising zero monitors hits a BUG_ON and takes down the client nodeCVE-2026-68155 · Linux kernel libceph (ceph_monmap_decode, zero-monitor monmap)High
• Linux kernel libceph: NULL dereference in CRUSH locality lookup when a parent bucket's type name is missingCVE-2026-68157 · Linux kernel libceph (get_immediate_parent CRUSH type name lookup)High