CVE-2026-64003

In the Linux kernel, the following vulnerability has been resolved:

scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues

While a SCSI host is in a recovery state, scsi_mq_requeue_cmd() will not

set the requeue list for a requeued command to be kicked in the future.

The expectation is a call to scsi_run_host_queues() will kick all SCSI

devices once the recovery state is cleared.

However, scsi_run_host_queues() uses shost_for_each_device() which uses

scsi_device_get() and so will ignore devices in a partially removed

state like SDEV_CANCEL. But these devices may also have requeued

requests, leaving their requests stuck from not being kicked and causing

the removal process of the device to hang.

scsi_run_host_queues() needs to run against more devices than the macro

shost_for_each_device() allows. Instead of using the too limiting

scsi_device_get() state checks, only ignore devices in SDEV_DEL state or

when unable to acquire a reference. Attempt to run the queues for all

other devices when scsi_run_host_queues() is called.