CVE-2026-97483

A flaw was found in the Linux kernel. During error recovery or reset operations for USB storage devices connected to a root hub, the USB subsystem fails to respect memory allocation constraints during control transfers. A local user triggering device error recovery under memory pressure can cause recursive storage input/output (I/O) operations, leading to a kernel deadlock and a Denial of Service (DoS).

A low impact deadlock flaw was found in the Linux kernel USB core subsystem. When the SCSI error handler performs error recovery or a reset of a USB-attached SCSI (UAS) or USB storage device, the operation involves control transfers to the device's parent, which may be a root hub. The root hub control transfer handling in usbcore did not honor the memory allocation flags passed to usb_submit_urb(), so under memory pressure the memory allocation could trigger direct reclaim and recursively wait on storage I/O from within the SCSI error handler, deadlocking the kernel and causing a denial of service. A local attacker able to trigger error recovery or a reset of a USB storage device on a system under memory pressure could provoke this deadlock.

The kernel and kernel-rt components in Red Hat Enterprise Linux 7, 8, 9, and 10, the kernel components of Red Hat In-Vehicle OS, and the RHEL CoreOS 8/9 based nodes of OpenShift Container Platform are listed as affected. Because the flaw is difficult to trigger, requiring a specific race between USB storage error handling, device reset, and system memory pressure, and because the consequence is limited to availability, the fix is deferred to a future update of the affected products; the residual risk is a system hang or stalled storage error recovery if those conditions coincide. Red Hat Enterprise Linux 6 is out of support scope. Although the Red Hat CVSS:3.1 base score is 5.5 (Moderate), Red Hat rates the impact of this flaw as Low due to the demanding preconditions required to trigger the deadlock and the denial-of-service-only consequence.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.