Executive brief
A vulnerability in the Linux kernel's storage subsystem could allow certain disk commands to be indefinitely delayed or 'starved' when the system is under heavy load. This affects how the operating system communicates with SATA storage devices, potentially leading to application hangs or system instability during intense disk activity. The issue has been resolved by improving how the kernel manages different types of disk command queues.
Technical details
A race condition and scheduling flaw existed in the libata-scsi SAT (SCSI to ATA Translation) implementation. When a non-NCQ command was issued while NCQ commands were in-flight, the kernel would return SCSI_MLQUEUE_XXX_BUSY, deferring the command. On systems with multiple submission queues and high NCQ traffic, the non-NCQ command could be repeatedly bypassed by new NCQ commands from other CPUs, leading to starvation. The fix implements a forward-progress guarantee by introducing a deferred command field (deferred_qc) and a dedicated work item (deferred_qc_work) to ensure non-NCQ commands are processed once the device queue drains, while temporarily deferring all new incoming commands to prevent further starvation.
Affected products
- Linux Linux Kernel All versions prior to the fix in 2026
Timeline
- 2025-12-17: patched: Initial patch authored by Damien Le Moal
- 2026-05-27: advisory: CVE-2026-45855 published