CVE-2026-93057None▾ Sunlit

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset. In that context, fun…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Sep 17, 2026

Updated

Sep 17, 2026

CVSS

—

Vendor

Linux

Product

Linux

CWE

—

Depth score

3 · Minimal

EPSS

0.20% · p9

Platforms

—

Source

NVD

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Sep 19.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 8 days

Sep 17, 2026Published
Disclosed via NVD
Sep 19, 2026EPSS first tracked
0.2%
Sep 25, 2026EPSS peak
0.2% → 0.2%

Linux #nvd #cve.org

Affected

Linux >= 03e5d38e2f985d8d0b0a60508c0b422f664808e3 < a28a7d9b3bb116da788ae492c90465ec1a7fa6e8
Linux >= 03e5d38e2f985d8d0b0a60508c0b422f664808e3 < 760fc6f0e25a72832c2fcf37ecf5f1b770ec8374
Linux 7.1

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context

TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset. In that context, functions ufshcd_tx_eqtr(), __ufshcd_tx_eqtr() and ufs_qcom_get_rx_fom() allocate memory with GFP_KERNEL. If direct reclaim is triggered, reclaim/writeback can depend on I/O to UFS device. Because the queue is quiesced, this can cause deadlock.

Use memalloc_noio_save/restore() in ufshcd_tx_eqtr() to cover all allocations in the TX EQTR call tree, including:

params->eqtr_record in ufshcd_tx_eqtr()
eqtr_data in __ufshcd_tx_eqtr()
params in ufs_qcom_get_rx_fom()

This is preferred over tagging individual call sites with GFP_NOIO, as it automatically covers any future allocations added anywhere in the call tree without requiring each caller to be aware of this constraint.

[mkp: fix label as suggested by Bart]

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org