---
id: "CVE-2026-98478"
kind: "vulnerability"
aliases: ["CVE-2026-98478"]
title: "Linux kernel: UFS error recovery can deadlock on internal commands"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["embedded", "linux-kernel", "runtime", "ufs"]
not_affected_if: ["no-ufs-hardware"]
published_at: "2026-10-18T16:16:58+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:25:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98478", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel: UFS error recovery can deadlock on internal commands

In the Linux kernel's UFS storage driver, error recovery quiesces the shared tag set, which stops internal commands from being dispatched and leaves the driver in a circular-wait deadlock. The sources describe a hang during UFS error handling rather than a confirmed way for an attacker to gain access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update to a Linux kernel release that includes the upstream commit fixing scsi: ufs: core: Keep internal commands dispatchable during error handling; the sources do not name the fixed version.

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98478

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Keep internal commands dispatchable during error handling

Commit 08b12cda6c44 ("scsi: ufs: core: Switch to scsi_get_internal_cmd()")
switched UFS internal commands to allocate requests on
hba->host->pseudo_sdev->request_queue, which shares the host tagset with
regular LUNs.

During error recovery, ufshcd_err_handling_prepare() calls
blk_mq_quiesce_tagset(&hba->host->tag_set), marking all queues in the
tagset as quiesced, including pseudo_sdev->request_queue. When
ufshcd_verify_dev_init() subsequently issues internal commands (e.g. NOP
OUT UPIU) via blk_execute_rq(), blk_mq_run_hw_queue() skips running the
quiesced queue, resulting in an unrecoverable circular wait deadlock.

Keep quiescing the tagset and unquiesce the pseudo SCSI device on top of
that, so internal commands stay dispatchable while the logical units remain
quiesced. Re-quiesce the pseudo device before unquiescing the tagset so
that quiesce_depth stays balanced.

Clock scaling and ufshcd_pause_command_processing() are unaffected: they
keep quiescing the whole tagset, internal commands included.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_