{"apiVersion":"1.0","identifier":"CVE-2026-74754","description":"In the Linux kernel, the following vulnerability has been resolved: scsi: core: pair EH runtime PM get and put shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host(). That is racy when a PM-triggered error path flips shost->eh_noresume while the SCSI EH thread is still running. The problem flow looks like this: PM path ufshcd_set_dev_pwr_mode() shost->eh_noresume = 1 ufshcd_execute_start_stop <-- trigger EH ... shost->eh_noresume = 0 EH path scsi_error_handler() if (!shost->eh_noresume) scsi_autopm_get_host() <-- skipped ... if (!shost->eh_noresume) scsi_autopm_put_host() <-- executed later In that case one EH iteration can skip autoresume on entry and still drop a runtime PM reference on exit. That leaves an unmatched runtime PM put and can trigger a runtime PM usage count underflow. Fix this by making eh_noresume a regular bool so it can be accessed with READ_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use that snapshot for both runtime PM get and put decisions.","publishedAt":"2026-08-26T15:16:54","lastModifiedAt":"2026-08-26T15:16:54","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74754","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00155,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74754","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74754","en":"https://www.redsauce.net/en/cves/CVE-2026-74754","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74754","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74754","de":"https://www.redsauce.net/de/cves/CVE-2026-74754","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74754","el":"https://www.redsauce.net/el/cves/CVE-2026-74754"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74754"}}