CVE-2026-98478

Received Received - Intake

Deadlock in Linux Kernel UFS Core Due to Tagset Quiescing

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()") switched UFS internal commands to allocate requests on hba->host->pseudo_sdev->request_queue, which shares the host tagset with regular LUNs. During error recovery, ufshcd_err_handling_prepare() calls blk_mq_quiesce_tagset(&hba->host->tag_set), marking all queues in the tagset as quiesced, including pseudo_sdev->request_queue. When ufshcd_verify_dev_init() subsequently issues internal commands (e.g. NOP OUT UPIU) via blk_execute_rq(), blk_mq_run_hw_queue() skips running the quiesced queue, resulting in an unrecoverable circular wait deadlock. Keep quiescing the tagset and unquiesce the pseudo SCSI device on top of that, so internal commands stay dispatchable while the logical units remain quiesced. Re-quiesce the pseudo device before unquiescing the tagset so that quiesce_depth stays balanced. Clock scaling and ufshcd_pause_command_processing() are unaffected: they keep quiescing the whole tagset, internal commands included.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98478

EUVD

EUVD-2026-103718

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	08b12cda6c44dc015bcc152613c35ee0ae8f37b9
Linux	Linux	08b12cda6c44dc015bcc152613c35ee0ae8f37b9
Linux	Linux	6.19

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the SCSI UFS (Universal Flash Storage) core driver. It involves a deadlock during error recovery where internal commands cannot be dispatched because the request queue is quiesced along with the tagset, preventing recovery operations from completing.

Detection Guidance

This vulnerability is specific to the Linux kernel's UFS (Universal Flash Storage) driver and requires kernel-level inspection. Check if your system uses a vulnerable kernel version by running uname -a. Look for kernel logs indicating UFS errors or deadlocks during error recovery.

Impact Analysis

This vulnerability could cause system hangs or crashes during UFS storage device error recovery. It may lead to data corruption or loss if the system becomes unresponsive during critical operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel-specific issue related to SCSI UFS error handling that could lead to system deadlocks but does not involve data breaches or unauthorized access.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this vulnerability. Monitor kernel logs for UFS-related errors or deadlocks. If you cannot update immediately, consider disabling UFS devices if they are not critical.

Hi! I’m here to help you understand CVE-2026-98478. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70