CVE-2026-23110: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23110 is a race condition vulnerability in the Linux kernel's SCSI core subsystem, specifically in the error handler wake-up logic when final command completions race against each other. The flaw affects Linux kernel versions 5.5 through 5.10.249, 5.11 through 6.1.162, 6.2 through 6.6.122, 6.7 through 6.12.68, and 6.13 through 6.18.8, as well as release candidates 6.19-rc1 through 6.19-rc6. It was published on February 4, 2026, with patches released on March 18, 2026. The vulnerability carries a CVSS v3.1 base score of 4.7 (Medium) (Feedly).

The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / Race Condition). Two distinct race conditions exist within the SCSI core: first, a memory ordering issue in scsi_dec_host_busy() where the write clearing SCMD_STATE_INFLIGHT may be reordered with reads in scsi_host_busy(), causing other CPUs to observe an inflated busy count and preventing any CPU from detecting that host busy equals host_failed; second, a general ordering issue in scsi_eh_inc_host_failed() where busy commands are counted before incrementing host_failed, allowing it to race with a final command in scsi_dec_host_busy(). The fix introduces a memory barrier on the error path to enforce write visibility before counting host busy commands, and reorders the operations in scsi_eh_inc_host_failed(). Exploitation requires local access with low privileges and high attack complexity (Feedly, Kernel Patches).

Successful triggering of this race condition results in the SCSI error handler failing to wake up, leaving all I/O through the affected SCSI host permanently stuck and unable to advance through the error recovery state machine. The impact is limited to availability — there is no confidentiality or integrity impact. This can cause a full denial of service for storage I/O on affected systems, potentially requiring a reboot to recover, which is particularly severe in production server environments relying on SCSI-attached storage (Feedly).

The Linux kernel project has released patches addressing this vulnerability across all affected stable branches. Fixed versions include 5.10.249, 6.1.162, 6.6.122, 6.12.68, and 6.18.8. Six upstream patch commits are available in the stable kernel tree. Downstream distributions including Oracle Linux, Ubuntu, and Amazon Linux 2 have issued updated kernel packages incorporating these fixes. Administrators should update to the patched kernel version appropriate for their distribution as soon as possible; no configuration-based workaround is available (Feedly, Kernel Patches, Amazon Linux Advisory).