{"id":"CVE-2026-99207","aliases":[],"title":"scsi: target: Disable interrupts while holding delayed_cmd_lock","titleSource":"Linux","descriptionSource":"Linux","products":[{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"06933066d88a3093953b062922c016a67d2cdbf8","status":"affected","lessThan":"7563650522732041ccfb2e4593878b5ea98d498c","versionType":"git"},{"version":"06933066d88a3093953b062922c016a67d2cdbf8","status":"affected","lessThan":"04a67a8b1a4460345d22fe75d93430cbf7e651d7","versionType":"git"}],"defaultStatus":"unaffected","source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-99207"},{"vendor":"Linux","name":"Linux","platforms":[],"versions":[{"version":"7.1","status":"affected"},{"version":"0","status":"unaffected","lessThan":"7.1","versionType":"semver"},{"version":"7.2.13","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"defaultStatus":"affected","source":"Linux","url":"https://www.cve.org/CVERecord?id=CVE-2026-99207"}],"remediation":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Disable interrupts while holding delayed_cmd_lock\n\ntarget_do_delayed_work() takes dev->delayed_cmd_lock with a plain\nspin_lock(). It runs from system_percpu_wq, so interrupts stay enabled\nwhile the lock is held. Every other acquisition of that lock uses\nspin_lock_irqsave(): target_handle_task_attr() and\ntransport_complete_ordered_sync() in target_core_transport.c, and\ntarget_non_ordered_release() in target_core_device.c.\n\nThat was safe while every caller of transport_complete_task_attr() ran\nin process context: target_complete_ok_work() from target_completion_wq,\ntransport_complete_qf() from dev->qf_work_queue, and\ntransport_generic_request_failure() from the submit and execute paths.\n\nSince commit 06933066d88a (\"scsi: target: Add support for completing\ncommands from backend context\") that is no longer true. With\ncomplete_type=1 on a fabric that sets direct_compl_supp,\ntarget_complete() runs target_complete_ok_work() inline in the backend's\ncompletion context, which target_complete_cmd_with_sense() documents as\n\"May be called from interrupt context\". For iblock that is the bio\nend_io.\n\ntarget_complete_ok_work() starts with transport_complete_task_attr(),\nwhich takes delayed_cmd_lock in two ways:\n\n - Every ORDERED command is put on dev->delayed_cmd_list by\n   target_handle_task_attr() and dispatched from there by\n   target_do_delayed_work(), which marks it SCF_TASK_ORDERED_SYNC.  Its\n   completion therefore goes through transport_complete_ordered_sync().\n\n - A SIMPLE command that completes while an ORDERED command is pending\n   drops the last reference to the killed dev->non_ordered, and\n   percpu_ref_put() then runs target_non_ordered_release() in the\n   completing context.\n\nBoth take the lock and, if commands are waiting, call\nschedule_work(&dev->delayed_cmd_work), which queues on system_percpu_wq,\ni.e. on the CPU that took the completion. Further completions for the\nsame queue are typically delivered there too, so one arriving while the\nwork holds the lock spins on it forever.\n\nReaching this needs complete_type=1, which is not the default\n(vhost-scsi, the only fabric with direct_compl_supp, defaults to\nTARGET_QUEUE_COMPL), a backend whose I/O completes from interrupt\ncontext, and ORDERED commands from the initiator. Linux virtio_scsi\nguests send only VIRTIO_SCSI_S_SIMPLE and never take the ordered path;\nany guest that uses the ORDERED task attribute, which vhost-scsi\naccepts, does.\n\ntarget_do_delayed_work() is a work item and always runs in process\ncontext, so spin_lock_irq() is sufficient.\n\nFound by inspection; no runtime report. A single ORDERED command goes\nthrough both acquisitions, so with CONFIG_PROVE_LOCKING the first one\ncompleted through direct completion should produce an inconsistent lock\nstate report on delayed_cmd_lock (hardirq or softirq, depending on where\nthe backend completes).","severity":"unknown","score":null,"published":"2026-10-28T10:36:00.728Z","modified":"2026-10-28T10:36:00.728Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://git.kernel.org/stable/c/7563650522732041ccfb2e4593878b5ea98d498c","https://git.kernel.org/stable/c/04a67a8b1a4460345d22fe75d93430cbf7e651d7"],"sources":[{"name":"CVE","id":"CVE-2026-99207","modified":"2026-10-28T10:36:00.728Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-99207"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T15:40:31.878Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}