CVE-2024-26627: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26627 affects the Linux kernel's SCSI subsystem, specifically the error handler (EH) wakeup mechanism. The vulnerability was discovered in early 2024 and affects systems using SCSI devices with multiple hardware queues and large queue depths (Kernel Git).

The vulnerability exists in the scsi_eh_wakeup() function where scsi_host_busy() is called and checked with host lock to determine if the error handler kthread needs to be woken up. When recovery is triggered with all requests in-flight, each scsi_eh_wakeup() call is strictly serialized. For systems with N hardware queues and queue depth M, this results in scsi_host_busy() being called (N * M - 1) times, with requests being iterated (N*M - 1) * (N * M) times. This can trigger a hard lockup when acquiring the host lock on systems with large N and M values, as observed on mpi3mr devices with 128 hardware queues and queue depth 8169 (Kernel Git).

The vulnerability can lead to a denial of service condition through system hard lockups when SCSI error recovery is triggered on systems with large numbers of hardware queues and queue depths (Kernel Git). This is particularly impactful for storage systems using SCSI devices with high-performance configurations.

The vulnerability requires local access to a system with SCSI devices configured with multiple hardware queues and large queue depths. It is triggered during SCSI error recovery conditions, making it a reliability issue rather than a security exploit vector (CISA ADP).

The issue has been fixed by moving the scsi_host_busy() call outside the host lock in the error handler wakeup path. The fix has been implemented because the host lock is not required for getting the busy count. The patch has been reviewed and tested by multiple kernel developers including Ewan D. Milne, Sathya Prakash Veerichetty, and Bart Van Assche (Kernel Git).