CVE-2026-93781

A flaw was found in the Linux kernel's SCSI (Small Computer System Interface) subsystem, which can lead to a Denial of Service (DoS). During device error recovery, the error handling mechanism attempts to allocate request tags while all available tags are held by pending commands waiting for recovery to complete. A local user able to trigger storage error recovery on affected devices, such as USB storage, can induce this circular dependency and cause a permanent input/output (I/O) deadlock.

This vulnerability is rated with a Low severity impact because exploiting it requires local privileges or specific hardware interactions to initiate error recovery conditions, and typical enterprise workloads do not expose storage management or recovery paths to unprivileged users. In standard Red Hat Enterprise Linux deployments, access to underlying storage interfaces and device recovery operations is restricted to administrative accounts, preventing unprivileged actors from readily triggering I/O failures. Even if error recovery is initiated on affected single-tag devices such as removable drives, the resulting hang is limited to storage I/O processing and does not compromise system confidentiality or data integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.