CVE-2026-45855 Overview
CVE-2026-45855 is a Linux kernel vulnerability in the libata-scsi SAT (SCSI/ATA Translation) implementation. The flaw allows non-NCQ (Native Command Queuing) commands to be starved when a target device is under constant NCQ command load from multiple submission queues. Because the block layer and SCSI layer do not distinguish between queueable and non-queueable commands, ata_scsi_qc_issue() repeatedly defers non-NCQ commands with SCSI_MLQUEUE_XXX_BUSY, leading to extended delays or complete starvation.
Critical Impact
Non-NCQ commands can experience indefinite execution delays on host adapters with multiple submission queues under sustained NCQ workloads, resulting in degraded storage I/O reliability and potential denial of service.
Affected Products
- Linux kernel libata-scsi SAT implementation
- Host adapters utilizing multiple submission queues with ATA devices
- Systems running affected upstream Linux kernel revisions prior to the fix commits
Discovery Timeline
- 2026-05-27 - CVE-2026-45855 published to NVD
- 2026-05-27 - Last updated in NVD database
Technical Details for CVE-2026-45855
Vulnerability Analysis
The ACS specifications prohibit mixing NCQ and non-NCQ commands on the same ATA device. When ata_scsi_qc_issue() receives a non-NCQ command while NCQ commands are in-flight, it returns SCSI_MLQUEUE_XXX_BUSY to defer the command. This deferral is correct in single-queue contexts.
On host adapters with multiple submission queues, NCQ commands originating from different CPUs can continuously occupy the device queue. The deferred non-NCQ command may be requeued indefinitely as new NCQ commands arrive ahead of it from other submission queues. This produces long execution delays and, in pathological workloads, complete starvation of non-NCQ commands.
Root Cause
The root cause lies in the absence of forward-progress guarantees for non-NCQ commands in the libata SAT layer. Hardware and firmware-based SAT implementations on SAS HBAs enforce such guarantees, but the software SAT path relied solely on the SCSI layer's busy-requeue mechanism, which provides no fairness between queueable and non-queueable commands across multiple submission queues.
Attack Vector
The condition is reachable from local user workloads that sustain heavy NCQ traffic against an ATA device while non-NCQ commands (such as cache flush, TRIM in some paths, or SMART operations) are concurrently issued. A workload generating constant queued reads or writes from multiple CPUs can effectively block non-NCQ command completion, producing storage I/O stalls.
The upstream fix introduces a deferred_qc field in struct ata_port to hold a pending non-NCQ command instead of returning busy. A work item deferred_qc_work runs ata_scsi_deferred_qc_work() to dispatch the held command once qc_defer() indicates the device queue has drained. The helper ata_scsi_schedule_deferred_qc() is invoked from ata_scsi_qc_complete(). While deferred_qc is non-NULL, all subsequent commands are deferred via the regular busy mechanism, preventing denial of service from excessive non-NCQ submission. ata_scsi_requeue_deferred_qc() is called from ata_eh_set_pending() so the deferred command is retried after error handling completes.
Detection Methods for CVE-2026-45855
Indicators of Compromise
- Prolonged I/O latency or hung-task warnings referencing ATA/SCSI command timeouts under heavy queued workloads
- Kernel log entries showing repeated SCSI_MLQUEUE_DEVICE_BUSY or SCSI_MLQUEUE_HOST_BUSY returns from ata_scsi_qc_issue()
- Application-level stalls on filesystem operations such as fsync, cache flush, or SMART queries on busy ATA devices
Detection Strategies
- Audit running kernel versions across Linux fleets and compare against the fix commits 0ea84089dbf6, 5d61a38a60e6, 888cd7e40adb, and ce22aaed0112
- Monitor block I/O latency histograms (iostat, bpftrace, or eBPF tracepoints on block_rq_*) for sustained tail latencies on ATA devices under multi-queue HBAs
- Correlate hung-task or blocked for more than N seconds messages with concurrent NCQ workload patterns
Monitoring Recommendations
- Track per-device average and p99 service times for sda-class ATA devices behind multi-queue controllers
- Alert on kernel messages referencing ata_scsi_qc_issue, qc_defer, or repeated SCSI requeue events
- Maintain inventory of kernel build versions and patch levels via configuration management to ensure fix adoption
How to Mitigate CVE-2026-45855
Immediate Actions Required
- Apply the upstream Linux kernel patches that introduce the deferred_qc mechanism in libata-scsi
- Update affected systems to a distribution kernel that incorporates the fix commits referenced in the kernel.org stable tree
- Verify after patching that struct ata_port includes the deferred_qc field and that ata_scsi_deferred_qc_work() is present
Patch Information
The fix is distributed across the following upstream commits: Kernel Git Commit 0ea84089, Kernel Git Commit 5d61a38a, Kernel Git Commit 888cd7e4, and Kernel Git Commit ce22aaed. These commits add the deferred QC field, the work item dispatch path, integration with error handling via ata_eh_set_pending(), and the completion-time scheduler helper.
Workarounds
- Reduce concurrent NCQ workload pressure on affected ATA devices by limiting parallel I/O issuers per device
- Where supported, disable NCQ via the libata.force=noncq kernel parameter to eliminate the mixing scenario at the cost of throughput
- Pin storage I/O to fewer CPUs to limit the number of active submission queues feeding the target device
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
