{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "ae0751ffc77e7f21629970fdab5528c573e637f8"
            },
            {
              "fixed": "e83eed1bea142c8fe852fd53156845b88252ecd8"
            },
            {
              "fixed": "872f486259ae0bc6b73ca4735a15d013241f73e9"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.3.0"
            },
            {
              "fixed": "7.1.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74754.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: pair EH runtime PM get and put\n\nshost-\u003eeh_noresume is currently consulted twice in one error handling\niteration: once before scsi_autopm_get_host() and once again before\nscsi_autopm_put_host().\n\nThat is racy when a PM-triggered error path flips shost-\u003eeh_noresume\nwhile the SCSI EH thread is still running.\n\nThe problem flow looks like this:\nPM path\n  ufshcd_set_dev_pwr_mode()\n    shost-\u003eeh_noresume = 1\n    ufshcd_execute_start_stop  \u003c-- trigger EH\n    ...\n    shost-\u003eeh_noresume = 0\n\nEH path\n  scsi_error_handler()\n    if (!shost-\u003eeh_noresume)\n      scsi_autopm_get_host()  \u003c-- skipped\n    ...\n    if (!shost-\u003eeh_noresume)\n       scsi_autopm_put_host()  \u003c-- executed later\n\nIn that case one EH iteration can skip autoresume on entry and still\ndrop a runtime PM reference on exit. That leaves an unmatched runtime PM\nput and can trigger a runtime PM usage count underflow.\n\nFix this by making eh_noresume a regular bool so it can be accessed with\nREAD_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use\nthat snapshot for both runtime PM get and put decisions.",
  "id": "CVE-2026-74754",
  "modified": "2026-08-28T11:30:35.759114636Z",
  "published": "2026-08-26T14:37:00.766Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/872f486259ae0bc6b73ca4735a15d013241f73e9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e83eed1bea142c8fe852fd53156845b88252ecd8"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74754.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74754"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "scsi: core: pair EH runtime PM get and put"
}