{"id":"CVE-2026-99202","kind":"vulnerability","aliases":["CVE-2026-99202"],"related":[],"title":"Linux kernel: SCSI libsas SMP command can deadlock during host resume","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: libsas: Fix SMP IO deadlock during HA resume\n\nsmp_execute_task_sg() calls pm_runtime_get_sync() on the host before\nissuing an SMP command. When that command is itself issued from the HA\nresume path, the get_sync() deadlocks: it waits for the ongoing resume\n(the device is RPM_RESUMING), while the resume is blocked in\nsas_drain_work() waiting for that same SMP IO to complete.\n\nThe deadlock needs an expander-attached SATA disk. During\nsas_resume_ha() -> sas_drain_work(), DISCE_RESUME -> sas_resume_sata()\n-> ata_sas_port_resume() requests ATA_EH_RESET, and the hard reset for\nsuch a disk is done via SMP PHY CONTROL (sas_ata_hard_reset() ->\nsas_phy_reset() -> sas_smp_phy_control() ->\nsmp_execute_task_sg()). Direct-attached SATA resets through\nlldd_control_phy() and SSP devices use TMFs, so neither hits this.\n\nReplace the get_sync()/put_sync() pair with\npm_runtime_get_noresume()/pm_runtime_put(). smp_execute_task_sg() only\nneeds to hold off autosuspend while the SMP is in flight, and it must\nnot try to resume the host: a sync resume issued from the HA resume path\nitself is what deadlocks, and by the time sas_resume_ha() runs, hw_init\nhas already reinitialized the hardware, so the device is accessible\nwithout one.\n\nThe usage reference is still required. Discovery work normally runs\ninside an event worker's PM reference, taken at sas_notify_port_event()\nnotify time and held until the handler has flushed the disco\nqueue. sas_rediscover_ex_phy() however requeues DISCE_REVALIDATE_DOMAIN\nfrom within the revalidation worker itself, and flush_workqueue() does\nnot wait for work items queued during execution, so that chained\nrevalidation runs with no outer PM reference - without the\nget_noresume(), its SMP could race autosuspend.\n\nFor the BSG path, sas_smp_handler() is the only caller which may find\nthe host autosuspended: expander SMP requests do not go through any SCSI\ndevice request queue, so nothing else in that path holds the host\nawake. Resume it there with pm_runtime_resume_and_get() and check the\nresult.","summary":"A flaw in the Linux kernel's libsas SCSI layer can deadlock when an SMP command is issued from the host resume path, because a runtime-PM get_sync waits on the resume that is itself blocked. The sources do not state a confirmed attacker outcome beyond a hang of the affected host during resume.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","other","sas","scsi","servers"],"not_affected_if":["no-sas-expander","no-suspend-resume"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit 'scsi: libsas: Fix SMP IO deadlock during HA resume' (exact version unknown from the sources)","status":"open","published_at":"2026-10-28T11:17:41+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:34:01+00:00","updated_at":"2026-10-28T11:34:01+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-28T11:34:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit 'scsi: libsas: Fix SMP IO deadlock during HA resume' (exact version unknown from the sources)","reach":"local","title":"Linux kernel: SCSI libsas SMP command can deadlock during host resume","impact":"low","summary":"A flaw in the Linux kernel's libsas SCSI layer can deadlock when an SMP command is issued from the host resume path, because a runtime-PM get_sync waits on the resume that is itself blocked. The sources do not state a confirmed attacker outcome beyond a hang of the affected host during resume.","category":"other","nicknames":[],"who_cares":["linux-kernel","sas","scsi","servers"],"confidence":0.5,"needs_auth":"unknown","worst_case":"affected host hangs during suspend or resume recovery","analyst_note":"Check the upstream kernel commit for affected and fixed versions and confirm whether this is a denial-of-service only; NVD entry lacks scores and version ranges.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-sas-expander","no-suspend-resume"],"who_is_affected":"Hosts running a Linux kernel with libsas (SAS HBAs) that use expander-attached SATA disks, where the host goes through a system suspend/resume cycle. Systems without SAS expanders or without suspend/resume are unlikely to hit the deadlock. unknown for exact kernel versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000681,"input_tokens":4041,"output_tokens":554,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99202':14A,17A '/pm_runtime_put':247C '/put_sync':240C 'access':305C 'affect':77B 'alreadi':297C 'ata':181C,186C,204C 'attach':166C,220C 'attack':70B 'autosuspend':257C,388C,405C 'awak':427C 'beyond':72B 'block':62B,147C 'bsg':391C 'call':104C 'caller':399C 'chain':372C 'check':438C 'command':6A,40B,116C,119C 'complet':159C 'confirm':69B 'control':202C,213C,225C 'could':386C 'cve':12A,15A 'deadlock':8A,36B,96C,131C,161C,285C 'devic':139C,229C,303C,415C 'direct':219C 'direct-attach':218C 'disc':176C,349C 'disco':341C 'discoveri':314C 'disk':168C,196C 'domain':351C 'done':198C 'drain':150C,174C 'eh':187C 'els':420C 'event':320C,330C 'ex':345C 'execut':101C,215C,249C,369C 'expand':165C,406C 'expander-attach':164C 'find':402C 'fix':93C 'flaw':26B 'flight':263C 'flush':339C,359C 'follow':86C 'get':53B,107C,129C,238C,245C,382C,436C 'go':411C 'ha':98C,125C,172C,279C,292C 'handler':337C,395C 'hang':74B 'hard':191C,205C 'hardwar':300C 'held':334C 'hit':234C 'hold':255C,424C 'host':10A,45B,78B,111C,272C,404C,426C 'howev':347C 'hw':294C 'init':295C 'insid':318C 'io':95C,157C 'issu':42B,113C,122C,276C 'item':366C 'kernel':2A,20B,30B,84C 'layer':34B 'libsa':4A,32B,92C 'linux':1A,19B,29B,83C 'linux-kernel':18B 'lldd':224C 'may':401C 'must':266C 'need':162C,253C 'neither':233C 'noresum':246C,383C 'normal':316C 'noth':419C 'notifi':328C,331C 'one':307C 'ongo':136C 'outcom':71B 'outer':377C 'pair':241C 'path':47B,127C,281C,392C,423C 'phi':201C,208C,212C,226C,346C 'pm':52B,105C,243C,323C,378C,432C 'port':183C,329C 'queu':367C 'queue':342C,417C 'race':387C 'rediscov':344C 'refer':310C,324C,379C 'reiniti':298C 'replac':236C 'request':185C,408C,416C 'requeu':348C 'requir':313C 'reset':188C,192C,206C,209C,222C 'resolv':90C 'result':440C 'resum':11A,46B,58B,80B,99C,126C,137C,142C,145C,171C,177C,179C,184C,270C,275C,280C,291C,428C,434C 'revalid':350C,355C,373C 'rpm':141C 'run':293C,317C,374C 'runtim':51B,106C,244C,433C 'runtime-pm':50B 'sas':22B,149C,170C,173C,178C,182C,203C,207C,210C,290C,327C,343C,393C 'sata':167C,180C,221C 'scsi':3A,23B,33B,91C,414C 'server':24B 'sg':103C,217C,251C 'smp':5A,39B,94C,100C,115C,156C,200C,211C,214C,248C,260C,385C,394C,407C 'sourc':64B 'ssp':228C 'state':67B 'still':312C 'sync':54B,108C,130C,239C,274C 'taken':325C 'task':102C,216C,250C 'time':289C,332C 'tmfs':231C 'tri':268C 'usag':309C 'use':230C 'via':199C 'vulner':87C 'wait':55B,133C,152C,363C 'within':353C 'without':306C,380C 'work':151C,175C,315C,365C 'worker':321C,356C 'workqueu':360C","nicknames":[],"mitigations":[],"who_affected":"Hosts running a Linux kernel with libsas (SAS HBAs) that use expander-attached SATA disks, where the host goes through a system suspend/resume cycle. Systems without SAS expanders or without suspend/resume are unlikely to hit the deadlock. unknown for exact kernel versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99202","severity":null,"published_at":"2026-10-28T11:17:41+00:00","modified_at":"2026-10-28T11:17:41+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}