CVE-2026-68396

A flaw was found in the Linux kernel's SCSI core. A race condition exists when drivers use the scsi_schedule_eh function, which can prevent the error handler thread from waking up reliably. This occurs because of an unforced memory order between setting the host into error recovery state and counting busy commands. As a result, the system may experience a denial of service due to the failure of the error handler to properly manage SCSI device errors.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation is restricted to a local denial of service and relies on uncommon hardware or command timeout conditions during error recovery. An attacker with local access would need to trigger or coincide with I/O faults on SCSI devices handled by the subsystem. While a failure of the recovery thread can cause storage operations to become unresponsive, the flaw cannot be leveraged remotely or used to compromise system confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.