huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-22796: openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification
Component: openssl
Severity: Low
CWE: CWE-1287 (Improper Validation of Specified Type of Input)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-01-27T00:00:00+00:00

A flaw was found in OpenSSL. This type confusion vulnerability allows a remote attacker to cause a denial of service (DoS) by providing specially crafted PKCS#7 data to an application that performs signature verification. The vulnerability occurs because the application accesses an ASN1_TYPE union member without proper type validation, leading to an invalid or NULL pointer dereference and a crash.

Statement: This vulnerability is rated Low for Red Hat products. A type confusion flaw in the legacy PKCS#7 API can lead to a Denial of Service when processing specially crafted PKCS#7 data. Exploitation requires an application to perform signature verification of malformed PKCS#7 data. Red Hat products utilizing the FIPS module are not affected as the PKCS#7 parsing is outside the module boundary.

Affected upstream versions: 3.6.0 < 3.6.1, 3.5.0 < 3.5.5, 3.4.0 < 3.4.4, 3.3.0 < 3.3.6, 3.0.0 < 3.0.19, 1.1.1 < 1.1.1ze, 1.0.2 < 1.0.2zn
Fixed upstream versions: 1.0.2zn, 1.1.1ze, 3.0.19, 3.3.6, 3.4.4, 3.5.5, 3.6.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: ef2fb66ec571564d64d1c74a12e388a2a54d05d2
CVE-2026-22807: vLLM: vLLM: Arbitrary code execution via untrusted model loading
Component: vLLM
Severity: Important
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-01-21T21:13:11.894000+00:00

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability allows a remote attacker to achieve arbitrary code execution on the vLLM host during model loading. This occurs because vLLM loads Hugging Face `auto_map` dynamic modules without properly validating the `trust_remote_code` setting. By influencing the model repository or path, an attacker can execute malicious Python code at server startup, even before any API requests are handled.

Statement: This vulnerability is rated Important for Red Hat as vLLM, an inference and serving engine for large language models, is vulnerable to arbitrary code execution. An attacker influencing the model repository or path can execute malicious Python code during server startup, affecting vLLM versions 0.10.1 through 0.13.x.

Affected upstream versions: >= 0.10.1, < 0.14.0
Fixed upstream versions: v0.14.0
Upstream repository: https://github.com/vllm-project/vllm
Upstream fix commit: 78d13ea9de4b1ce5e4d8a5af9738fea71fb024e5
CVE-2026-2297: cpython: CPython: Logging Bypass in Legacy .pyc File Handling
Component: cpython
Severity: Low
CWE: CWE-778 (Insufficient Logging)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Public date: 2026-03-04T22:10:43.297000+00:00

A flaw was found in CPython. This vulnerability allows a local user with low privileges to bypass security auditing mechanisms. The issue occurs because the SourcelessFileLoader component, responsible for handling older Python compiled files (.pyc), does not properly trigger system audit events. This oversight could enable malicious activities to go undetected, compromising the integrity of the system.


Affected upstream versions: 3.14.0 < 3.14.4, 3.15.0a1 < 3.15.0a7
Fixed upstream versions: v3.13.13
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 482d6f8bdba9da3725d272e8bb4a2d25fb6a603e
CVE-2026-22979: kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-01-23T00:00:00+00:00

A flaw was found in the Linux kernel's networking component. Incorrect memory accounting when handling Generic Receive Offload (GRO) packets can lead to a persistent memory leak. This occurs because the system incorrectly tracks memory usage for network packets, preventing proper cleanup of network resources. Over time, this can lead to a denial of service (DoS) as system memory is gradually exhausted.


Affected upstream versions: 6.1.85 < 6.1.161, 6.6.26 < 6.6.121, 5.15.154 < 5.16, 6.8.5 < 6.9, 6.9
Fixed upstream versions: 0, 5.16, 6.1.161, 6.12.66, 6.18.6, 6.19, 6.6.121, 6.9
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0b27828ebd1ed3107d7929c3737adbe862e99e74
CVE-2026-22984: kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done()
Component: kernel
Severity: Moderate
CVSS v3: 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Public date: 2026-01-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

libceph: prevent potential out-of-bounds reads in handle_auth_done()

Perform an explicit bounds check on payload_len to avoid a possible
out-of-bounds access in the callout.

[ idryomov: changelog ]

Statement: An out-of-bounds read can occur in libceph messenger v2 during AUTH_DONE handling when payload_len is taken from the wire but the message buffer is not validated to actually contain that many bytes. A malicious or compromised Ceph peer can send a truncated message to reliably crash the kernel (network-triggered DoS).

Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.198, 6.1.161, 6.12.66, 6.18.6, 6.19, 6.6.121
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 194cfe2af4d2a1de599d39dad636b47c2f6c2c96
CVE-2026-22990: kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
Component: kernel
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2026-01-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

If the osdmap is (maliciously) corrupted such that the incremental
osdmap epoch is different from what is expected, there is no need to
BUG.  Instead, just declare the incremental osdmap to be invalid.

Statement: This is a reachable kernel BUG triggered by malformed (or maliciously corrupted) Ceph incremental OSD map data: an unexpected epoch value could hit a BUG_ON() and panic the kernel. The trigger is received over the Ceph protocol in established Ceph sessions (i.e., within the trusted/authorized cluster communication model), but it breaks that model by allowing a peer to cause a hard host crash.

Affected upstream versions: 2.6.34
Fixed upstream versions: 0, 5.10.248, 5.15.198, 6.1.161, 6.12.66, 6.18.6, 6.19, 6.6.121
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9aa0b0c14cefece078286d78b97d4c09685e372d
CVE-2026-22998: kernel: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.4 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2026-01-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec

Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length")
added ttag bounds checking and data_offset
validation in nvmet_tcp_handle_h2c_data_pdu(), but it did not validate
whether the command's data structures (cmd->req.sg and cmd->iov) have
been properly initialized before processing H2C_DATA PDUs.

The nvmet_tcp_build_pdu_iovec() function dereferences these pointers
without NULL checks. This can be triggered by sending H2C_DATA PDU
immediately after the ICREQ/ICRESP handshake, before
sending a CONNECT command or NVMe write command.

Attack vectors that trigger NULL pointer dereferences:
1. H2C_DATA PDU sent before CONNECT → both pointers NULL
2. H2C_DATA PDU for READ command → cmd->req.sg allocated, cmd->iov NULL
3. H2C_DATA PDU for uninitialized command slot → both pointers NULL

The fix validates both cmd->req.sg and cmd->iov before calling
nvmet_tcp_build_pdu_iovec(). Both checks are required because:
- Uninitialized commands: both NULL
- READ commands: cmd->req.sg allocated, cmd->iov NULL
- WRITE commands: both allocated

Statement: A NULL-pointer dereference in the NVMe/TCP target path occurs because nvmet_tcp_build_pdu_iovec() can be called when cmd.req.sg and/or cmd.iov are not initialized. A remote host can trigger this by sending an out-of-order H2C_DATA PDU immediately after the ICREQ/ICRESP handshake (e.g., before CONNECT), causing a kernel crash (DoS). Privileges are typically not required beyond network reachability to the NVMe/TCP target.
NVMe/TCP targets are typically deployed inside isolated storage or data-center networks and are not exposed to the public Internet. In practice, exploitation usually requires access to a local or trusted internal network where NVMe/TCP is used for remote memory or storage access over TCP.

Affected upstream versions: 5.10.209 < 5.10.249, 5.15.148 < 5.15.199, 6.1.75 < 6.1.162, 6.6.14 < 6.6.122, 5.4.268 < 5.5, 6.7.2 < 6.8, 6.8
Fixed upstream versions: 0, 5.10.249, 5.15.199, 5.5, 6.1.162, 6.12.67, 6.18.7, 6.19, 6.6.122, 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: baabe43a0edefac8cd7b981ff87f967f6034dafe
CVE-2026-23001: kernel: macvlan: fix possible UAF in macvlan_forward_source()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-01-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

macvlan: fix possible UAF in macvlan_forward_source()

Add RCU protection on (struct macvlan_source_entry)->vlan.

Whenever macvlan_hash_del_source() is called, we must clear
entry->vlan pointer before RCU grace period starts.

This allows macvlan_forward_source() to skip over
entries queued for freeing.

Note that macvlan_dev are already RCU protected, as they
are embedded in a standard netdev (netdev_priv(ndev)).

https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE@google.com/T/#u

Statement: A use-after-free can occur in macvlan source-mode forwarding when a source hash entry is deleted while the transmit/forwarding path still dereferences entry.vlan without proper RCU protection. A local attacker who can configure macvlan networking can race deletion with packet processing to crash the kernel and potentially achieve memory corruption.
Exploitation typically requires the CAP_NET_ADMIN capability (often within a user namespace).

Affected upstream versions: 3.18
Fixed upstream versions: 0, 5.10.249, 5.15.199, 6.1.162, 6.12.67, 6.18.7, 6.19, 6.6.122
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8133e85b8a3ec9f10d861e0002ec6037256e987e
CVE-2026-23002: kernel: lib/buildid: use __kernel_read() for sleepable context
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-01-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

lib/buildid: use __kernel_read() for sleepable context

Prevent a "BUG: unable to handle kernel NULL pointer dereference in
filemap_read_folio".

For the sleepable context, convert freader to use __kernel_read() instead
of direct page cache access via read_cache_folio().  This simplifies the
faultable code path by using the standard kernel file reading interface
which handles all the complexity of reading file data.

At the moment we are not changing the code for non-sleepable context which
uses filemap_get_folio() and only succeeds if the target folios are
already in memory and up-to-date.  The reason is to keep the patch simple
and easier to backport to stable kernels.

Syzbot repro does not crash the kernel anymore and the selftests run
successfully.

In the follow up we will make __kernel_read() with IOCB_NOWAIT work for
non-sleepable contexts.  In addition, I would like to replace the
secretmem check with a more generic approach and will add fstest for the
buildid code.

Statement: A kernel NULL pointer dereference could be triggered in the lib buildid sleepable parsing path because it accessed file data through direct page cache folio operations and could reach filemap_read_folio in an unsafe state. This leads to a host kernel crash and denial of service. For the CVSS the PR is L because triggering typically requires a local user to exercise buildid parsing through available kernel interfaces such as BPF or related tooling and to provide inputs that force the faultable read path. The issue is not network reachable by itself and depends on local access and system configuration. Impact is denial of service only.

Affected upstream versions: 6.12
Fixed upstream versions: 0, 6.12.67, 6.18.7, 6.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b11dfb7708f212b96c7973a474014c071aa02e05
CVE-2026-23010: kernel: Linux kernel: Use-after-free in IPv6 address deletion may lead to a denial of service
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2026-01-25T00:00:00+00:00

A flaw was found in the Linux kernel. An issue exists in the `inet6_addr_del()` function, where a use-after-free vulnerability can be triggered due to an incorrect order of operations when deleting IPv6 temporary addresses. A local attacker with low privileges could exploit this flaw to potentially cause a denial of service, disclose sensitive information, or achieve privilege escalation.


Affected upstream versions: 6.1.120 < 6.1.162, 6.6.64 < 6.6.122, 6.12.2 < 6.12.67, 6.11.11 < 6.12, 6.13
Fixed upstream versions: 0, 6.1.162, 6.12, 6.12.67, 6.18.7, 6.19, 6.6.122
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6e89d60b4f03014f7d412ce64b17a840840d490e
CVE-2026-23040: kernel: wifi: mac80211_hwsim: fix typo in frequency notification
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211_hwsim: fix typo in frequency notification

The NAN notification is for 5745 MHz which corresponds to channel 149
and not 5475 which is not actually a valid channel. This could result in
a NULL pointer dereference in cfg80211_next_nan_dw_notif.

Statement: The mac80211_hwsim virtual WiFi driver contains an incorrect frequency constant used when generating NAN discovery window notifications on the 5 GHz band that can lead to Null pointer deref. In mac80211_hwsim_nan_dw_start the driver calls ieee80211_get_channel with 5475 MHz when nan_curr_dw_band is NL80211_BAND_5GHZ. That frequency does not correspond to a valid channel in typical wiphy channel tables so ieee80211_get_channel may return NULL. Subsequent NAN notification processing in cfg80211 may then dereference the channel pointer and crash the kernel in cfg80211_next_nan_dw_notif leading to a denial of service. The issue is most relevant in test and simulation environments where mac80211_hwsim is loaded and NAN simulation is enabled. A local attacker with permissions to configure wireless interfaces and NAN behavior can trigger the faulty path by enabling NAN simulation and causing 5 GHz NAN discovery window scheduling.

Affected upstream versions: 6.18
Fixed upstream versions: 0, 6.18.6, 6.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1251bbdb8f5b2ea86ca9b4268a2e6aa34372ab33
CVE-2026-23060: kernel: Linux kernel: Denial of Service in authencesn due to too-short AAD
Component: kernel
Severity: Moderate
CWE: CWE-1284 (Improper Validation of Specified Quantity in Input)
CVSS v3: 6.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-02-04T00:00:00+00:00

A flaw was found in the Linux kernel's authencesn authenticated encryption with associated data implementation. A remote attacker can exploit this vulnerability by providing a specially crafted Associated Additional Data with a length shorter than the expected minimum. This can lead to a NULL pointer dereference, causing a kernel panic and resulting in a Denial of Service.

Statement: A denial of service can occur in the authencesn AEAD implementation when the associated data length is shorter than the minimum ESP ESN AAD size. With assoclen less than 8 the decrypt path can advance beyond the end of the destination scatterlist and later hit a NULL pointer dereference in scatterwalk_map_and_copy which can panic the kernel. For the CVSS the PR is N in the paranoid rating because an attacker does not need local privileges if they can reach a kernel user of authencesn with attacker controlled AAD. This is plausibly network reachable in deployments that use IPsec ESP with ESN or other kernel paths that feed ESP like AAD into authencesn. Impact is denial of service via kernel crash. There is no indication of information disclosure or privilege escalation from this fix.

Affected upstream versions: 4.3
Fixed upstream versions: 0, 5.10.249, 5.15.199, 6.1.162, 6.12.68, 6.18.8, 6.19, 6.6.122
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: df22c9a65e9a9daa368a72fed596af9d7d5876bb
CVE-2026-23066: kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.4 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-02-04T00:00:00+00:00

A flaw was found in the Linux kernel. A local unprivileged process can exploit an unsafe requeue path in the `rxrpc_recvmsg` function by using `AF_RXRPC` sockets with `MSG_DONTWAIT` and `MSG_PEEK` flags. This improper handling of the receive message queue can lead to memory corruption, such as Use-After-Frees (UAFs) or reference count underruns. The most likely outcome is a kernel crash or memory safety warning, resulting in a denial of service. There is also a conservative possibility of broader impact if the memory corruption is exploitable.

Statement: An unsafe requeue path in rxrpc_recvmsg can corrupt the recvmsg queue because a call is requeued unconditionally even if it is already on the queue due to MSG_PEEK or a concurrent IO thread requeue. This can corrupt the linked list bookkeeping and can manifest as use after free or refcount underrun in RXRPC call objects. The most likely outcome is a kernel crash or memory safety warning which results in denial of service. For the CVSS the PR is N because a local unprivileged process can trigger the behavior by using AF_RXRPC sockets and recvmsg with MSG_DONTWAIT and MSG_PEEK patterns. The issue is not directly network reachable as a pure remote packet trigger because the vulnerable operation is in the local recvmsg path. Remote traffic can influence timing and queue state but a local caller is still needed to exercise the buggy logic. Impact is primarily availability with a conservative possibility of broader impact if the memory corruption is exploitable.

Affected upstream versions: 4.11
Fixed upstream versions: 0, 5.10.258, 5.15.209, 6.1.175, 6.12.78, 6.18.8, 6.19, 6.6.130
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8fd3b5e297854a4da0f273169baf4b1b7b257b97
CVE-2026-23074: kernel: Linux kernel: Use-after-free in teql queueing discipline can lead to privilege escalation
Component: kernel
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-02-04T00:00:00+00:00

A flaw was found in the Linux kernel's networking component. A local attacker with low privileges could exploit a design issue in the teql queueing discipline, which is responsible for managing network traffic. By sending specially crafted network packets, an attacker could trigger a use-after-free (UAF) vulnerability, which is a type of memory corruption. This could lead to a system crash, or potentially allow the attacker to execute unauthorized code or gain elevated system access.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.249, 5.15.199, 6.1.162, 6.12.68, 6.18.8, 6.19, 6.6.122
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 73d970ff0eddd874a84c953387c7f4464b705fc6
CVE-2026-23097: kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2026-02-04T00:00:00+00:00

A flaw was found in the Linux kernel. A local attacker could exploit a deadlock vulnerability due to incorrect lock ordering between folio_lock and i_mmap_rwsem when migrating hugetlb file-backed folios. This could lead to hung tasks and potential system-wide stalls, resulting in a Denial of Service (DoS).

Statement: A deadlock can occur when migrating hugetlb file backed folios due to incorrect lock ordering between folio_lock and the mapping i_mmap_rwsem. One task in the migration path can hold folio_lock and then block on i_mmap_lock_read. Another task such as hugetlbfs fallocate or punch hole can hold i_mmap_lock_write and then block on folio_lock. This ABBA pattern can hang tasks indefinitely and lead to a denial of service. For the CVSS the PR is N because the involved operations can be triggered by normal users who can access hugetlbfs and run memory pressure and file operations. The issue is not network reachable. Impact is denial of service due to hung tasks and potential system wide stalls.

Affected upstream versions: 5.9.9 < 5.10, 5.10
Fixed upstream versions: 0, 5.10, 5.10.249, 5.15.199, 6.1.162, 6.12.68, 6.18.8, 6.19, 6.6.122
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e7396d23f9d5739f56cf9ab430c3a169f5508394
CVE-2026-23110: kernel: scsi: core: Wake up the error handler when final completions race against each other
Component: kernel
Severity: Low
CWE: CWE-821 (Incorrect Synchronization)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-02-04T00:00:00+00:00

Race condition vulnerabilities were found in the Linux kernel's SCSI error handler wake-up logic. Memory ordering issues in scsi_dec_host_busy() and ordering problems in scsi_eh_inc_host_failed() can cause the SCSI error handler to never wake up when command completions race against each other. This leaves I/O stuck indefinitely as the error recovery state cannot advance.

Statement: These race conditions affect SCSI host error recovery under concurrent command completion scenarios. When triggered, SCSI I/O becomes permanently stuck waiting for error handler intervention that never comes. The issue requires specific timing of command completions on multi-CPU systems and manifests as hung I/O operations that never complete.

Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.249, 6.1.162, 6.12.68, 6.18.8, 6.19, 6.6.122
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cc872e35c0df80062abc71268d690a2f749e542e