CVE-2026-74754

A low impact race condition flaw was found in the Linux kernel SCSI core. The shost->eh_noresume flag is consulted twice within a single SCSI error handling (EH) iteration, once before scsi_autopm_get_host() and again before scsi_autopm_put_host(). If a power-management-triggered error path, such as the UFS device power mode transition path, changes shost->eh_noresume while the SCSI EH thread is still running, one EH iteration can skip the runtime PM autoresume on entry but still drop a runtime PM reference on exit. This unmatched runtime PM put can cause a runtime PM usage count underflow, resulting in system instability or a denial of service. Exploitation requires local access and a specific timing window between runtime power management operations and SCSI error recovery; the flaw affects availability only, with no impact on confidentiality or integrity.

The kernel and kernel-rt components in Red Hat Enterprise Linux 7, 8, 9, and 10, and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS, are affected. The fix is currently deferred for these products; given the low impact rating and the narrow timing window required to trigger the race, the residual risk until a fix is released is limited to a local denial of service or system instability from the runtime PM usage count underflow. Red Hat's LOW impact rating reflects this limited practical exploitability, which is lower than what the CVSS 5.5 (Moderate) availability-only score alone would suggest.