CVE-2026-68395 Overview
CVE-2026-68395 is a Linux kernel vulnerability in the sata_dwc_460ex SATA controller driver. The driver enables SATA interrupts before registering an interrupt handler through platform_get_irq() and ata_host_activate(). If a probe step fails or the controller asserts an interrupt during initialization, the IRQ line fires without a registered handler. This condition triggers a spurious interrupt storm that can degrade system stability on affected platforms.
Critical Impact
A spurious interrupt storm during driver probe can destabilize systems using the Synopsys DesignWare SATA controller on 460EX-based platforms.
Affected Products
- Linux kernel builds including the sata_dwc_460ex driver
- Platforms using the Synopsys DesignWare AHCI SATA controller (AMCC 460EX)
- Embedded and PowerPC systems relying on this driver during boot
Discovery Timeline
- 2026-08-10 - CVE-2026-68395 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68395
Vulnerability Analysis
The sata_dwc_460ex driver initializes the Synopsys DesignWare SATA controller during platform probe. The function sata_dwc_enable_interrupts() unmasks the controller's interrupt sources before the kernel registers an interrupt service routine. Any interrupt asserted between unmasking and handler registration reaches the CPU with no consumer.
The kernel responds to unhandled interrupt lines by escalating through spurious IRQ tracking. Repeated assertions cause an interrupt storm that consumes CPU cycles and can prevent the driver from completing initialization. The issue is a Kernel Vulnerability with denial-of-service characteristics on affected hardware.
Root Cause
The root cause is an ordering defect in driver initialization. sata_dwc_enable_interrupts() executes before platform_get_irq() and ata_host_activate(). The controller's interrupt mask is opened while the OS has not yet bound a handler. Subsequent failures in irq request, PHY initialization, or later probe steps leave the mask enabled while the handler never registers.
Attack Vector
The defect is triggered during driver probe on platforms that instantiate the sata_dwc_460ex device. No remote attacker interaction is required. The failure surfaces when the controller asserts an interrupt during initialization or when a downstream probe step fails. The upstream fix reorders the sequence so that sata_dwc_enable_interrupts() runs after ata_host_activate() completes.
See the upstream commits for the applied fix: Kernel Git Commit 23d4c50, Kernel Git Commit 4bbc16a, Kernel Git Commit 5d0797d, Kernel Git Commit daa80b4, and Kernel Git Commit fbe7df5.
Detection Methods for CVE-2026-68395
Indicators of Compromise
- Kernel log entries containing irq X: nobody cared messages associated with the SATA controller line
- disabling IRQ warnings issued by the spurious interrupt subsystem during boot
- Elevated CPU consumption in ksoftirqd immediately after sata_dwc_460ex probe
- Failed ata_host_activate() sequences in dmesg output on 460EX platforms
Detection Strategies
- Parse dmesg and /var/log/kern.log on affected hardware for spurious IRQ warnings referencing the SATA controller
- Correlate probe-time boot logs with running kernel version against fixed stable branches listed in the upstream commits
- Track kernel build inventory across embedded and PowerPC fleets to identify systems shipping vulnerable driver code
Monitoring Recommendations
- Forward kernel ring buffer output to a centralized log platform and alert on nobody cared or Disabling IRQ strings
- Monitor SATA device enumeration failures and I/O errors following boot on impacted hardware
- Track kernel package versions across managed Linux endpoints to confirm patch coverage
How to Mitigate CVE-2026-68395
Immediate Actions Required
- Identify systems that load the sata_dwc_460ex driver, particularly AMCC 460EX and Synopsys DesignWare SATA platforms
- Apply the stable kernel update that reorders sata_dwc_enable_interrupts() to run after ata_host_activate()
- Reboot affected hosts after patching to load the corrected driver initialization path
Patch Information
The fix moves sata_dwc_enable_interrupts() after ata_host_activate() so the SATA controller's interrupt mask is only opened once a handler is registered. The change is available in the upstream stable branches referenced in the commits 23d4c50, 4bbc16a, 5d0797d, daa80b4, and fbe7df5.
Workarounds
- Blacklist the sata_dwc_460ex module on systems that do not require SATA controller functionality until patches are applied
- Restrict kernel builds to versions containing the reordered probe sequence for fleets on Synopsys DesignWare SATA hardware
- Where patching is delayed, avoid warm reboots and probe cycles that could re-trigger the spurious interrupt condition
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
