CVE-2026-74526

Received Received - Intake

Deadlock in Linux Kernel SCSI MPI3MR Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit mpi3mr_fault_uevent_emit() runs from the fault watchdog and reset paths where host I/O may already be blocked. GFP_KERNEL allocations here, both the local kzalloc_obj() and the ones inside kobject_uevent_env() itself, can trigger reclaim that waits on that blocked I/O and deadlock. Use memalloc_noio_save()/restore() to cover the whole call instead of just the local allocation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74526

EUVD

EUVD-2026-59719

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a deadlock can occur in the mpi3mr driver. The function mpi3mr_fault_uevent_emit() runs during fault recovery or reset operations when host I/O is already blocked. Normal memory allocations (GFP_KERNEL) inside this function can trigger reclaim operations that wait for the blocked I/O, causing a deadlock situation.

Detection Guidance

This vulnerability is specific to the Linux kernel's SCSI driver (mpi3mr) and may not have direct detection commands. Monitor kernel logs for deadlock warnings or I/O stalls related to mpi3mr. Check for system hangs during fault events or resets. Use 'dmesg | grep mpi3mr' to inspect driver logs.

Impact Analysis

If exploited, this vulnerability could cause system hangs or crashes during storage operations. Systems using affected Linux kernel versions with the mpi3mr driver may become unresponsive when encountering storage faults or during recovery processes.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel-specific issue related to a potential deadlock in the SCSI driver (mpi3mr) during fault handling, which could impact system stability and availability but does not involve data privacy or security breaches.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update to a kernel version containing the fix for mpi3mr_fault_uevent_emit(). Avoid manual workarounds as they may disrupt system stability. Monitor vendor advisories for updates.

Hi! I’m here to help you understand CVE-2026-74526. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70