Executive brief
The Linux kernel's sata_dwc_460ex SATA driver contains an infinite loop bug in its NCQ (Native Command Queueing) completion handler. When specific bit patterns are present, the driver becomes stuck in a tight loop while holding a spinlock in interrupt context, causing system hangs and making the affected storage device unavailable until reboot.
Technical details
The vulnerability is an infinite loop in the NCQ tag completion path (sata_dwc_460ex driver) caused by unsafe bit-scanning logic. When tag_mask has only high bits set (e.g., 0x80000000), the inner while loop left-shifts tag_mask until it overflows to zero; at that point the condition !(0 & 1) remains true indefinitely while 0 <<= 1 stays zero, trapping the code in an infinite loop. The loop executes in hardirq context while holding a spinlock, causing a system hang. The fix replaces the hand-rolled bit-scanning with the __ffs() kernel function, which correctly finds the least significant set bit and is bounded by bit-width. Patches are available in upstream Linux kernel and stable branches.
Affected products
- Linux Linux kernel Multiple versions (affected in sata_dwc_460ex driver since introduction; patched in stable branches)
Timeline
- 2026-07-12: other: Patch authored by Rosen Penev
- 2026-08-03: patched: Committed to stable kernel trees
- 2026-08-12: disclosed: Published as CVE-2026-68449