CVE-2026-74754

A flaw was found in the Linux kernel SCSI core. A race condition exists where the shost->eh_noresume flag is checked multiple times during error handling. This can lead to an incorrect handling of power management (PM) references, specifically an unmatched reference put. The consequence is a runtime PM usage count underflow, which could result in system instability or a denial of service.

A low impact race condition flaw was found in the Linux kernel SCSI core. The shost->eh_noresume flag is consulted twice within a single SCSI error handling (EH) iteration, once before scsi_autopm_get_host() and again before scsi_autopm_put_host(). If a power-management-triggered error path, such as the UFS device power mode transition path, changes shost->eh_noresume while the SCSI EH thread is still running, one EH iteration can skip the runtime PM autoresume on entry but still drop a runtime PM reference on exit. This unmatched runtime PM put can cause a runtime PM usage count underflow, resulting in system instability or a denial of service. Exploitation requires local access and a specific timing window between runtime power management operations and SCSI error recovery; the flaw affects availability only, with no impact on confidentiality or integrity.

The kernel and kernel-rt components in Red Hat Enterprise Linux 7, 8, 9, and 10, and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS, are affected. The fix is currently deferred for these products; given the low impact rating and the narrow timing window required to trigger the race, the residual risk until a fix is released is limited to a local denial of service or system instability from the runtime PM usage count underflow. Red Hat's LOW impact rating reflects this limited practical exploitability, which is lower than what the CVSS 5.5 (Moderate) availability-only score alone would suggest.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.