CVE-2026-74555

A flaw was found in the scsi: libsas component of the Linux kernel. A deadlock can occur during the system resume process, preventing the host from becoming fully operational. Additionally, a race condition can cause the controller to suspend prematurely while disks are still waking up. This can lead to disk input/output (I/O) operations failing and the affected disks becoming disabled, resulting in a denial of service (DoS).

Red Hat has evaluated this issue as having a Low severity impact because triggering the race condition or deadlock requires specific power-management transitions during device resume on systems utilizing Serial Attached SCSI (SAS) controllers, rather than unprivileged remote manipulation. Standard enterprise servers generally run continuously without invoking suspend or sleep states, significantly minimizing exposure in production deployments. Furthermore, the failure mode is restricted to a local denial of service affecting drive responsiveness during host awakening, without compromising system confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.