{"id":"CVE-2026-98478","kind":"vulnerability","aliases":["CVE-2026-98478"],"related":[],"title":"Linux kernel: UFS error recovery can deadlock on internal commands","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Keep internal commands dispatchable during error handling\n\nCommit 08b12cda6c44 (\"scsi: ufs: core: Switch to scsi_get_internal_cmd()\")\nswitched UFS internal commands to allocate requests on\nhba->host->pseudo_sdev->request_queue, which shares the host tagset with\nregular LUNs.\n\nDuring error recovery, ufshcd_err_handling_prepare() calls\nblk_mq_quiesce_tagset(&hba->host->tag_set), marking all queues in the\ntagset as quiesced, including pseudo_sdev->request_queue. When\nufshcd_verify_dev_init() subsequently issues internal commands (e.g. NOP\nOUT UPIU) via blk_execute_rq(), blk_mq_run_hw_queue() skips running the\nquiesced queue, resulting in an unrecoverable circular wait deadlock.\n\nKeep quiescing the tagset and unquiesce the pseudo SCSI device on top of\nthat, so internal commands stay dispatchable while the logical units remain\nquiesced. Re-quiesce the pseudo device before unquiescing the tagset so\nthat quiesce_depth stays balanced.\n\nClock scaling and ufshcd_pause_command_processing() are unaffected: they\nkeep quiescing the whole tagset, internal commands included.","summary":"In the Linux kernel's UFS storage driver, error recovery quiesces the shared tag set, which stops internal commands from being dispatched and leaves the driver in a circular-wait deadlock. The sources describe a hang during UFS error handling rather than a confirmed way for an attacker to gain access.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","linux-kernel","runtime","ufs"],"not_affected_if":["no-ufs-hardware"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit fixing scsi: ufs: core: Keep internal commands dispatchable during error handling; the sources do not name the fixed version.","status":"open","published_at":"2026-10-18T16:16:58+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:53+00:00","updated_at":"2026-10-25T05:25:53+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:25:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit fixing scsi: ufs: core: Keep internal commands dispatchable during error handling; the sources do not name the fixed version.","reach":"local","title":"Linux kernel: UFS error recovery can deadlock on internal commands","impact":"low","summary":"In the Linux kernel's UFS storage driver, error recovery quiesces the shared tag set, which stops internal commands from being dispatched and leaves the driver in a circular-wait deadlock. The sources describe a hang during UFS error handling rather than a confirmed way for an attacker to gain access.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","ufs","embedded"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Storage hangs and the device stops responding until reboot","analyst_note":"Check the upstream kernel commit and the NVD entry for affected and fixed kernel versions and whether any remote trigger exists.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-ufs-hardware"],"who_is_affected":"Systems running a Linux kernel with a UFS host controller, typically some mobile and embedded devices, where UFS error recovery can occur. The sources do not say which kernel versions are affected or whether attackers can trigger the condition. Systems without UFS storage are unlikely to be affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000633,"input_tokens":3689,"output_tokens":529,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98478':13A,16A '08b12cda6c44':96C 'access':74B 'alloc':111C 'attack':71B 'balanc':231C 'blk':136C,171C,174C 'call':135C 'circular':52B,188C 'circular-wait':51B 'clock':232C 'cmd':105C 'command':10A,41B,90C,109C,165C,207C,237C,248C 'commit':95C 'confirm':67B 'core':87C,99C 'cve':11A,14A 'deadlock':7A,54B,190C 'depth':229C 'describ':57B 'dev':160C 'devic':200C,221C 'dispatch':44B,91C,209C 'driver':30B,48B 'e.g':166C 'embed':17B 'err':132C 'error':4A,31B,62B,93C,129C 'execut':172C 'follow':80C 'gain':73B 'get':103C 'handl':63B,94C,133C 'hang':59B 'hba':114C,140C 'host':115C,123C,141C 'hw':177C 'includ':152C,249C 'init':161C 'intern':9A,40B,89C,104C,108C,164C,206C,247C 'issu':163C 'keep':88C,191C,242C 'kernel':2A,20B,26B,78C 'leav':46B 'linux':1A,19B,25B,77C 'linux-kernel':18B 'logic':212C 'lun':127C 'mark':144C 'mq':137C,175C 'nop':167C 'paus':236C 'prepar':134C 'process':238C 'pseudo':116C,153C,198C,220C 'queue':119C,146C,156C,178C,183C 'quiesc':33B,138C,151C,182C,192C,215C,218C,228C,243C 'rather':64B 're':217C 're-quiesc':216C 'recoveri':5A,32B,130C 'regular':126C 'remain':214C 'request':112C,118C,155C 'resolv':84C 'result':184C 'rq':173C 'run':176C,180C 'runtim':21B 'scale':233C 'scsi':85C,97C,102C,199C 'sdev':117C,154C 'set':37B,143C 'share':35B,121C 'skip':179C 'sourc':56B 'stay':208C,230C 'stop':39B 'storag':29B 'subsequ':162C 'switch':100C,106C 'tag':36B,142C 'tagset':124C,139C,149C,194C,225C,246C 'top':202C 'uf':3A,22B,28B,61B,86C,98C,107C 'ufshcd':131C,158C,235C 'unaffect':240C 'unit':213C 'unquiesc':196C,223C 'unrecover':187C 'upiu':169C 'verifi':159C 'via':170C 'vulner':81C 'wait':53B,189C 'way':68B 'whole':245C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with a UFS host controller, typically some mobile and embedded devices, where UFS error recovery can occur. The sources do not say which kernel versions are affected or whether attackers can trigger the condition. Systems without UFS storage are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98478","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98478","severity":null,"published_at":"2026-10-18T16:16:58+00:00","modified_at":"2026-10-19T10:18:58+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}