CVE-2021-47192

In the Linux kernel, the following vulnerability has been resolved: scsi: core: sysfs: Fix hang when device state is set via sysfs This fixes a regression added with: commit f0f82e2476f6 ("scsi: core: Fix capacity set to zero after offlinining device") The problem is that after iSCSI recovery, iscsid will call into the kernel to set the dev's state to running, and with that patch we now call scsi_rescan_device() with the state_mutex held. If the SCSI error handler thread is just starting to test the device in scsi_send_eh_cmnd() then it's going to try to grab the state_mutex. We are then stuck, because when scsi_rescan_device() tries to send its I/O scsi_queue_rq() calls -> scsi_host_queue_ready() -> scsi_host_in_recovery() which will return true (the host state is still in recovery) and I/O will just be requeued. scsi_send_eh_cmnd() will then never be able to grab the state_mutex to finish error handling. To prevent the deadlock move the rescan-related code to after we drop the state_mutex. This also adds a check for if we are already in the running state. This prevents extra scans and helps the iscsid case where if the transport class has already onlined the device during its recovery process then we don't need userspace to do it again plus possibly block that daemon.

• CWE-667

• https://git.kernel.org/stable/c/4edd8cd4e86dd3047e5294bbefcc0a08f66a430fPatch
• https://git.kernel.org/stable/c/a792e0128d232251edb5fdf42fb0f9fbb0b44a73Patch
• https://git.kernel.org/stable/c/bcc0e3175a976b7fa9a353960808adb0bb49ead8Patch
• https://git.kernel.org/stable/c/edd783162bf2385b43de6764f2d4c6e9f4f6be27Patch
• https://git.kernel.org/stable/c/4edd8cd4e86dd3047e5294bbefcc0a08f66a430fPatch
• https://git.kernel.org/stable/c/a792e0128d232251edb5fdf42fb0f9fbb0b44a73Patch
• https://git.kernel.org/stable/c/bcc0e3175a976b7fa9a353960808adb0bb49ead8Patch
• https://git.kernel.org/stable/c/edd783162bf2385b43de6764f2d4c6e9f4f6be27Patch

Published

Apr 10, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-47186In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2021-47187In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2021-47188In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2021-47189In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2021-47190In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2021-47191In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2021-47193In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2021-47194In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2021-47195In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2021-47196In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2021-47197In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2021-47198In the Linux kernel, the following vulnerability has been re…7.8