CVE-2026-45855

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-scsi: avoid Non-NCQ command starvation

When a non-NCQ command is issued while NCQ commands are being executed,

ata_scsi_qc_issue() indicates to the SCSI layer that the command issuing

should be deferred by returning SCSI_MLQUEUE_XXX_BUSY. This command

deferring is correct and as mandated by the ACS specifications since

NCQ and non-NCQ commands cannot be mixed.

However, in the case of a host adapter using multiple submission queues,

when the target device is under a constant load of NCQ commands, there

are no guarantees that requeueing the non-NCQ command will be executed

later and it may be deferred again repeatedly as other submission queues

can constantly issue NCQ commands from different CPUs ahead of the

non-NCQ command. This can lead to very long delays for the execution of

non-NCQ commands, and even complete starvation for these commands in the

worst case scenario.

Since the block layer and the S

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References