Answer in brief
CVE-2026-64003 records a High severity (CVSS 7.5) vulnerability in scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=8b566edbdbfb5cde31a322c57932694ff48125ed <15fb19af49f2073ed77fad16aaabc648b0ca6800 || >=8b566edbdbfb5cde31a322c57932694ff48125ed <d4dddfecdbb5467bef158d4e1486459808357fef || >=8b566edbdbfb5cde31a322c57932694ff48125ed <475f2b37a78f4c698967a7f14f325f04e24c9175 || >=8b566edbdbfb5cde31a322c57932694ff48125ed <c740e13e7fe32d8e4d9a1699f65b8daf6709895a || >=8b566edbdbfb5cde31a322c57932694ff48125ed <7205b58702273baf21d6ba7992e6ba15852325f7 | 15fb19af49f2073ed77fad16aaabc648b0ca6800, d4dddfecdbb5467bef158d4e1486459808357fef, 475f2b37a78f4c698967a7f14f325f04e24c9175, c740e13e7fe32d8e4d9a1699f65b8daf6709895a, 7205b58702273baf21d6ba7992e6ba15852325f7 |
| Linux/Linuxgeneric | 6.5 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues While a SCSI host is in a recovery state, scsi_mq_requeue_cmd() will not set the requeue list for a requeued command to be kicked in the future. The expectation is a call to scsi_run_host_queues() will kick all SCSI devices once the recovery state is cleared. However, scsi_run_host_queues() uses shost_for_each_device() which uses scsi_device_get() and so will ignore devices in a partially removed state like SDEV_CANCEL. But these devices may also have requeued requests, leaving their requests stuck from not being kicked and causing the removal process of the device to hang. scsi_run_host_queues() needs to run against more devices than the macro shost_for_each_device() allows. Instead of using the too limiting scsi_device_get() state checks, only ignore devices in SDEV_DEL state or when unable to acquire a reference. Attempt to run the queues for all other devices when scsi_run_host_queues() is called.
Quoted source text, attributed separately from HOL analysis.