CVE-2026-99207 (GCVE-0-2026-99207)
Vulnerability from cvelistv5
Published
2026-10-28 10:36
Modified
2026-10-28 10:36
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayed_cmd_lock target_do_delayed_work() takes dev->delayed_cmd_lock with a plain spin_lock(). It runs from system_percpu_wq, so interrupts stay enabled while the lock is held. Every other acquisition of that lock uses spin_lock_irqsave(): target_handle_task_attr() and transport_complete_ordered_sync() in target_core_transport.c, and target_non_ordered_release() in target_core_device.c. That was safe while every caller of transport_complete_task_attr() ran in process context: target_complete_ok_work() from target_completion_wq, transport_complete_qf() from dev->qf_work_queue, and transport_generic_request_failure() from the submit and execute paths. Since commit 06933066d88a ("scsi: target: Add support for completing commands from backend context") that is no longer true. With complete_type=1 on a fabric that sets direct_compl_supp, target_complete() runs target_complete_ok_work() inline in the backend's completion context, which target_complete_cmd_with_sense() documents as "May be called from interrupt context". For iblock that is the bio end_io. target_complete_ok_work() starts with transport_complete_task_attr(), which takes delayed_cmd_lock in two ways: - Every ORDERED command is put on dev->delayed_cmd_list by target_handle_task_attr() and dispatched from there by target_do_delayed_work(), which marks it SCF_TASK_ORDERED_SYNC. Its completion therefore goes through transport_complete_ordered_sync(). - A SIMPLE command that completes while an ORDERED command is pending drops the last reference to the killed dev->non_ordered, and percpu_ref_put() then runs target_non_ordered_release() in the completing context. Both take the lock and, if commands are waiting, call schedule_work(&dev->delayed_cmd_work), which queues on system_percpu_wq, i.e. on the CPU that took the completion. Further completions for the same queue are typically delivered there too, so one arriving while the work holds the lock spins on it forever. Reaching this needs complete_type=1, which is not the default (vhost-scsi, the only fabric with direct_compl_supp, defaults to TARGET_QUEUE_COMPL), a backend whose I/O completes from interrupt context, and ORDERED commands from the initiator. Linux virtio_scsi guests send only VIRTIO_SCSI_S_SIMPLE and never take the ordered path; any guest that uses the ORDERED task attribute, which vhost-scsi accepts, does. target_do_delayed_work() is a work item and always runs in process context, so spin_lock_irq() is sufficient. Found by inspection; no runtime report. A single ORDERED command goes through both acquisitions, so with CONFIG_PROVE_LOCKING the first one completed through direct completion should produce an inconsistent lock state report on delayed_cmd_lock (hardirq or softirq, depending on where the backend completes).
References
Impacted products
Vendor Product Version
Linux Linux Version: 06933066d88a3093953b062922c016a67d2cdbf8
Version: 06933066d88a3093953b062922c016a67d2cdbf8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/target_core_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7563650522732041ccfb2e4593878b5ea98d498c",
              "status": "affected",
              "version": "06933066d88a3093953b062922c016a67d2cdbf8",
              "versionType": "git"
            },
            {
              "lessThan": "04a67a8b1a4460345d22fe75d93430cbf7e651d7",
              "status": "affected",
              "version": "06933066d88a3093953b062922c016a67d2cdbf8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/target/target_core_transport.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.13",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Disable interrupts while holding delayed_cmd_lock\n\ntarget_do_delayed_work() takes dev-\u003edelayed_cmd_lock with a plain\nspin_lock(). It runs from system_percpu_wq, so interrupts stay enabled\nwhile the lock is held. Every other acquisition of that lock uses\nspin_lock_irqsave(): target_handle_task_attr() and\ntransport_complete_ordered_sync() in target_core_transport.c, and\ntarget_non_ordered_release() in target_core_device.c.\n\nThat was safe while every caller of transport_complete_task_attr() ran\nin process context: target_complete_ok_work() from target_completion_wq,\ntransport_complete_qf() from dev-\u003eqf_work_queue, and\ntransport_generic_request_failure() from the submit and execute paths.\n\nSince commit 06933066d88a (\"scsi: target: Add support for completing\ncommands from backend context\") that is no longer true. With\ncomplete_type=1 on a fabric that sets direct_compl_supp,\ntarget_complete() runs target_complete_ok_work() inline in the backend\u0027s\ncompletion context, which target_complete_cmd_with_sense() documents as\n\"May be called from interrupt context\". For iblock that is the bio\nend_io.\n\ntarget_complete_ok_work() starts with transport_complete_task_attr(),\nwhich takes delayed_cmd_lock in two ways:\n\n - Every ORDERED command is put on dev-\u003edelayed_cmd_list by\n   target_handle_task_attr() and dispatched from there by\n   target_do_delayed_work(), which marks it SCF_TASK_ORDERED_SYNC.  Its\n   completion therefore goes through transport_complete_ordered_sync().\n\n - A SIMPLE command that completes while an ORDERED command is pending\n   drops the last reference to the killed dev-\u003enon_ordered, and\n   percpu_ref_put() then runs target_non_ordered_release() in the\n   completing context.\n\nBoth take the lock and, if commands are waiting, call\nschedule_work(\u0026dev-\u003edelayed_cmd_work), which queues on system_percpu_wq,\ni.e. on the CPU that took the completion. Further completions for the\nsame queue are typically delivered there too, so one arriving while the\nwork holds the lock spins on it forever.\n\nReaching this needs complete_type=1, which is not the default\n(vhost-scsi, the only fabric with direct_compl_supp, defaults to\nTARGET_QUEUE_COMPL), a backend whose I/O completes from interrupt\ncontext, and ORDERED commands from the initiator. Linux virtio_scsi\nguests send only VIRTIO_SCSI_S_SIMPLE and never take the ordered path;\nany guest that uses the ORDERED task attribute, which vhost-scsi\naccepts, does.\n\ntarget_do_delayed_work() is a work item and always runs in process\ncontext, so spin_lock_irq() is sufficient.\n\nFound by inspection; no runtime report. A single ORDERED command goes\nthrough both acquisitions, so with CONFIG_PROVE_LOCKING the first one\ncompleted through direct completion should produce an inconsistent lock\nstate report on delayed_cmd_lock (hardirq or softirq, depending on where\nthe backend completes)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T10:36:00.728Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7563650522732041ccfb2e4593878b5ea98d498c"
        },
        {
          "url": "https://git.kernel.org/stable/c/04a67a8b1a4460345d22fe75d93430cbf7e651d7"
        }
      ],
      "title": "scsi: target: Disable interrupts while holding delayed_cmd_lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99207",
    "datePublished": "2026-10-28T10:36:00.728Z",
    "dateReserved": "2026-09-25T10:25:14.401Z",
    "dateUpdated": "2026-10-28T10:36:00.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.