Linux Kernel CVE-2026-64326

The vulnerability resides in bdev_mark_dead() in the Linux kernel block layer (block/bdev.c). When a block device undergoes surprise removal - meaning the hardware is already gone before orderly teardown completes - the function is called with @surprise = true. The filesystem-aware path fs_bdev_mark_dead() correctly honors this flag and skips sync_filesystem(). However, when no ->mark_dead holder callback is registered (bare block device path), the !surprise guard was inadvertently dropped during a prior refactor that wired up holder callbacks. As a result, sync_blockdev() is called unconditionally, issuing a writeback flush to a device that no longer exists. The writeback waits indefinitely in folio_wait_writeback(), deadlocking the NVMe reset worker. The specific trigger chain is nvme_mark_namespaces_dead() → blk_mark_disk_dead() → bdev_mark_dead(bdev, true) → sync_blockdev(). CWE is not assigned, but the root cause is a missing conditional guard - analogous to CWE-754 (improper check for unusual or exceptional conditions). CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.