CVE-2026-45855

A flaw was found in the Linux kernel's libata-scsi component. This vulnerability allows for a denial of service (DoS) where non-Native Command Queuing (NCQ) commands can experience significant delays or complete starvation. This occurs when non-NCQ commands are issued while NCQ commands are actively being processed, particularly in systems utilizing multiple submission queues, preventing the non-NCQ commands from being executed.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because the risk is confined to a local denial of service via I/O starvation, with no impact on confidentiality or system integrity. Triggering this condition requires an attacker or workload to issue non-NCQ operations alongside saturated NCQ command streams on multi-queue host adapters. Although affected storage devices may experience stalled or severely delayed processing of specific commands, the flaw cannot lead to privilege escalation or system takeover.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.