{"id":"CVE-2026-99207","kind":"vulnerability","aliases":["CVE-2026-99207"],"related":[],"title":"Linux kernel SCSI target: lock can spin forever under interrupt completion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Disable interrupts while holding delayed_cmd_lock\n\ntarget_do_delayed_work() takes dev->delayed_cmd_lock with a plain\nspin_lock(). It runs from system_percpu_wq, so interrupts stay enabled\nwhile the lock is held. Every other acquisition of that lock uses\nspin_lock_irqsave(): target_handle_task_attr() and\ntransport_complete_ordered_sync() in target_core_transport.c, and\ntarget_non_ordered_release() in target_core_device.c.\n\nThat was safe while every caller of transport_complete_task_attr() ran\nin process context: target_complete_ok_work() from target_completion_wq,\ntransport_complete_qf() from dev->qf_work_queue, and\ntransport_generic_request_failure() from the submit and execute paths.\n\nSince commit 06933066d88a (\"scsi: target: Add support for completing\ncommands from backend context\") that is no longer true. With\ncomplete_type=1 on a fabric that sets direct_compl_supp,\ntarget_complete() runs target_complete_ok_work() inline in the backend's\ncompletion context, which target_complete_cmd_with_sense() documents as\n\"May be called from interrupt context\". For iblock that is the bio\nend_io.\n\ntarget_complete_ok_work() starts with transport_complete_task_attr(),\nwhich takes delayed_cmd_lock in two ways:\n\n - Every ORDERED command is put on dev->delayed_cmd_list by\n   target_handle_task_attr() and dispatched from there by\n   target_do_delayed_work(), which marks it SCF_TASK_ORDERED_SYNC.  Its\n   completion therefore goes through transport_complete_ordered_sync().\n\n - A SIMPLE command that completes while an ORDERED command is pending\n   drops the last reference to the killed dev->non_ordered, and\n   percpu_ref_put() then runs target_non_ordered_release() in the\n   completing context.\n\nBoth take the lock and, if commands are waiting, call\nschedule_work(&dev->delayed_cmd_work), which queues on system_percpu_wq,\ni.e. on the CPU that took the completion. Further completions for the\nsame queue are typically delivered there too, so one arriving while the\nwork holds the lock spins on it forever.\n\nReaching this needs complete_type=1, which is not the default\n(vhost-scsi, the only fabric with direct_compl_supp, defaults to\nTARGET_QUEUE_COMPL), a backend whose I/O completes from interrupt\ncontext, and ORDERED commands from the initiator. Linux virtio_scsi\nguests send only VIRTIO_SCSI_S_SIMPLE and never take the ordered path;\nany guest that uses the ORDERED task attribute, which vhost-scsi\naccepts, does.\n\ntarget_do_delayed_work() is a work item and always runs in process\ncontext, so spin_lock_irq() is sufficient.\n\nFound by inspection; no runtime report. A single ORDERED command goes\nthrough both acquisitions, so with CONFIG_PROVE_LOCKING the first one\ncompleted through direct completion should produce an inconsistent lock\nstate report on delayed_cmd_lock (hardirq or softirq, depending on where\nthe backend completes).","summary":"In the Linux kernel's SCSI target core, a lock used for ordered commands is taken without disabling interrupts, so a completion arriving from interrupt context can deadlock the CPU. The sources describe a local hang or denial of service, not code execution or data access.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kvm-hosts","linux-kernel","other","scsi-target","vhost-scsi"],"not_affected_if":["default-config","no-vhost-scsi","simple-tasks-only"],"how_to_check":"- Check the kernel version with `uname -r` and compare it against the fixed kernel versions listed in the NVD entry (unknown in the sources)\n- Check whether vhost-scsi is in use with `lsmod | grep vhost_scsi` and whether the target uses complete_type=1 (unknown in the sources)","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing delayed_cmd_lock (version unknown in the sources)","status":"open","published_at":"2026-10-28T11:17:42+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:33:54+00:00","updated_at":"2026-10-28T11:33:54+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-28T11:33:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing delayed_cmd_lock (version unknown in the sources)","reach":"local","title":"Linux kernel SCSI target: lock can spin forever under interrupt completion","impact":"low","summary":"In the Linux kernel's SCSI target core, a lock used for ordered commands is taken without disabling interrupts, so a completion arriving from interrupt context can deadlock the CPU. The sources describe a local hang or denial of service, not code execution or data access.","category":"other","nicknames":[],"who_cares":["linux-kernel","scsi-target","vhost-scsi","kvm-hosts"],"confidence":0.6,"needs_auth":"yes","worst_case":"A guest can hang a host CPU in a spin loop, causing denial of service","analyst_note":"Confirm the fixed kernel versions and the upstream commit from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-99207; the sources give no versions or severity score.","how_to_check":"- Check the kernel version with `uname -r` and compare it against the fixed kernel versions listed in the NVD entry (unknown in the sources)\n- Check whether vhost-scsi is in use with `lsmod | grep vhost_scsi` and whether the target uses complete_type=1 (unknown in the sources)","needs_analyst":true,"not_affected_if":["default-config","no-vhost-scsi","simple-tasks-only"],"who_is_affected":"Only hosts that run the Linux kernel's SCSI target core with a fabric that sets direct_compl_supp (vhost-scsi) and complete_type=1, a backend that completes I/O in interrupt context (such as iblock), and guests that send ORDERED task attributes. Default configurations and Linux virtio_scsi guests that only send SIMPLE commands are not reached by the described path. Teams not running LIO/target with these settings can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000784,"input_tokens":4308,"output_tokens":707,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99207':14A,17A '06933066d88a':201C '1':220C,417C 'accept':480C 'access':76B 'acquisit':127C,515C 'add':204C 'alway':491C 'arriv':53B,401C 'attr':138C,167C,274C,297C 'attribut':475C 'backend':210C,239C,439C,546C 'bio':262C 'call':253C,367C 'caller':162C 'cmd':94C,103C,246C,278C,291C,372C,537C 'code':72B 'command':44B,208C,285C,325C,331C,364C,448C,511C 'commit':200C 'compl':227C,431C,437C 'complet':11A,52B,141C,165C,173C,178C,181C,207C,218C,230C,233C,241C,245C,266C,272C,315C,320C,327C,356C,387C,389C,415C,442C,524C,527C,547C 'config':518C 'context':56B,171C,211C,242C,256C,357C,445C,495C 'core':38B,146C,155C 'cpu':60B,383C 'cve':12A,15A 'data':75B 'deadlock':58B 'default':422C,433C 'delay':93C,98C,102C,277C,290C,305C,371C,484C,536C 'deliv':396C 'denial':68B 'depend':542C 'describ':63B 'dev':101C,184C,289C,341C,370C 'device.c':156C 'direct':226C,430C,526C 'disabl':48B,89C 'dispatch':299C 'document':249C 'drop':334C 'enabl':119C 'end':263C 'everi':125C,161C,283C 'execut':73B,197C 'fabric':223C,428C 'failur':192C 'first':522C 'follow':82C 'forev':8A,411C 'found':502C 'generic':190C 'goe':317C,512C 'guest':455C,469C 'handl':136C,295C 'hang':66B 'hardirq':539C 'held':124C 'hold':92C,405C 'host':20B 'i.e':380C 'i/o':441C 'iblock':258C 'inconsist':531C 'initi':451C 'inlin':236C 'inspect':504C 'interrupt':10A,49B,55B,90C,117C,255C,444C 'io':264C 'irq':499C 'irqsav':134C 'item':489C 'kernel':2A,23B,34B,80C 'kill':340C 'kvm':19B 'kvm-host':18B 'last':336C 'linux':1A,22B,33B,79C,452C 'linux-kernel':21B 'list':292C 'local':65B 'lock':5A,40B,95C,104C,109C,122C,130C,133C,279C,361C,407C,498C,520C,532C,538C 'longer':215C 'mark':308C 'may':251C 'need':414C 'never':463C 'non':150C,342C,351C 'ok':174C,234C,267C 'one':400C,523C 'order':43B,142C,151C,284C,312C,321C,330C,343C,352C,447C,466C,473C,510C 'path':198C,467C 'pend':333C 'percpu':114C,345C,378C 'plain':107C 'process':170C,494C 'produc':529C 'prove':519C 'put':287C,347C 'qf':182C,185C 'queue':187C,375C,393C,436C 'ran':168C 'reach':412C 'ref':346C 'refer':337C 'releas':152C,353C 'report':507C,534C 'request':191C 'resolv':86C 'run':111C,231C,349C,492C 'runtim':506C 'safe':159C 'scf':310C 'schedul':368C 'scsi':3A,26B,30B,36B,87C,202C,425C,454C,459C,479C 'scsi-target':25B 'send':456C 'sens':248C 'servic':70B 'set':225C 'simpl':324C,461C 'sinc':199C 'singl':509C 'softirq':541C 'sourc':62B 'spin':7A,108C,132C,408C,497C 'start':269C 'state':533C 'stay':118C 'submit':195C 'suffici':501C 'supp':228C,432C 'support':205C 'sync':143C,313C,322C 'system':113C,377C 'take':100C,276C,359C,464C 'taken':46B 'target':4A,27B,37B,88C,96C,135C,145C,149C,154C,172C,177C,203C,229C,232C,244C,265C,294C,303C,350C,435C,482C 'task':137C,166C,273C,296C,311C,474C 'therefor':316C 'took':385C 'transport':140C,164C,180C,189C,271C,319C 'transport.c':147C 'true':216C 'two':281C 'type':219C,416C 'typic':395C 'use':41B,131C,471C 'vhost':29B,424C,478C 'vhost-scsi':28B,423C,477C 'virtio':453C,458C 'vulner':83C 'wait':366C 'way':282C 'whose':440C 'without':47B 'work':99C,175C,186C,235C,268C,306C,369C,373C,404C,485C,488C 'wq':115C,179C,379C","nicknames":[],"mitigations":[],"who_affected":"Only hosts that run the Linux kernel's SCSI target core with a fabric that sets direct_compl_supp (vhost-scsi) and complete_type=1, a backend that completes I/O in interrupt context (such as iblock), and guests that send ORDERED task attributes. Default configurations and Linux virtio_scsi guests that only send SIMPLE commands are not reached by the described path. Teams not running LIO/target with these settings can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99207","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99207","severity":null,"published_at":"2026-10-28T11:17:42+00:00","modified_at":"2026-10-28T11:17:42+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}