CVE-2026-23355

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ata: libata: cancel pending work after clearing deferred_qc

Syzbot reported a WARN_ON() in ata_scsi_deferred_qc_work(), caused by

ap->ops->qc_defer() returning non-zero before issuing the deferred qc.

ata_scsi_schedule_deferred_qc() is called during each command completion.

This function will check if there is a deferred QC, and if

ap->ops->qc_defer() returns zero, meaning that it is possible to queue the

deferred qc at this time (without being deferred), then it will queue the

work which will issue the deferred qc.

Once the work get to run, which can potentially be a very long time after

the work was scheduled, there is a WARN_ON() if ap->ops->qc_defer() returns

non-zero.

While we hold the ap->lock both when assigning and clearing deferred_qc,

and the work itself holds the ap->lock, the code currently does not cancel

the work after clearing the deferred qc.

This means that the following scenario can happen:

1) O

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References