{"id":"AZL-97791","summary":"CVE-2026-74754 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: pair EH runtime PM get and put\n\nshost-\u003eeh_noresume is currently consulted twice in one error handling\niteration: once before scsi_autopm_get_host() and once again before\nscsi_autopm_put_host().\n\nThat is racy when a PM-triggered error path flips shost-\u003eeh_noresume\nwhile the SCSI EH thread is still running.\n\nThe problem flow looks like this:\nPM path\n  ufshcd_set_dev_pwr_mode()\n    shost-\u003eeh_noresume = 1\n    ufshcd_execute_start_stop  \u003c-- trigger EH\n    ...\n    shost-\u003eeh_noresume = 0\n\nEH path\n  scsi_error_handler()\n    if (!shost-\u003eeh_noresume)\n      scsi_autopm_get_host()  \u003c-- skipped\n    ...\n    if (!shost-\u003eeh_noresume)\n       scsi_autopm_put_host()  \u003c-- executed later\n\nIn that case one EH iteration can skip autoresume on entry and still\ndrop a runtime PM reference on exit. That leaves an unmatched runtime PM\nput and can trigger a runtime PM usage count underflow.\n\nFix this by making eh_noresume a regular bool so it can be accessed with\nREAD_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use\nthat snapshot for both runtime PM get and put decisions.","modified":"2026-08-29T05:27:27Z","published":"2026-08-26T15:16:54Z","upstream":["CVE-2026-74754"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-74754"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-97791.json"}}],"schema_version":"1.9.0"}