CVE-2026-74555

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A deadlock and a race condition exist in the libsas component of the SCSI subsystem. A deadlock occurs when the PHYE RESUME TIMEOUT handler, executing on the HA event workqueue, calls sas deform port() and sas destruct devices(). This process removes SCSI devices and waits for the host to become runtime-active; however, the host cannot resume until sas resume ha() and its internal call to sas drain work() return, creating a circular dependency.

Additionally, a race condition affects hisi sas where the system may return from resume before PHY UP and libsas discovery work are completed. This can lead to the controller autosuspending while disks are still waking up, causing I/O failures and subsequent disk disablement. The issue is resolved by moving the PHYE RESUME TIMEOUT notification to occur after sas drain work(), breaking the deadlock cycle and allowing the restoration of the draining variant of sas resume ha() in hisi sas.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.