CVE-2026-99202

A flaw was found in the Linux kernel's libsas subsystem, leading to a denial of service (DoS). When resuming a host adapter connected to an expander-attached storage drive, an internal deadlock condition can occur while executing management commands. A local user can trigger this vulnerability during device power management resume operations to cause an unrecoverable system hang.

This vulnerability is rated as Moderate severity because exploitation requires elevated administrative privileges to execute power state changes and is constrained to specialized hardware configurations. In typical enterprise environments, the issue only manifests on hosts equipped with Serial Attached SCSI (SAS) controllers connected to SATA drives through SAS expanders. While a deadlock during host adapter power recovery results in a localized system freeze, it cannot be exploited remotely and does not lead to data loss or confidentiality exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.