Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-68449

ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.265, 5.15.216, 6.6.148, 6.12.101, 6.18.42, and 1 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning The hand-rolled bit-scanning loop in the NCQ completion path has an infinite loop bug. When tag_mask has only high bits set (e.g. 0x80000000), the inner while loop left-shifts tag_mask until it overflows to 0. At that point !(0 & 1) is always true and 0 <<= 1 stays 0, causing an infinite loop in hardirq context with a spinlock held. Replace the open-coded bit-scanning with __ffs() which correctly finds the least significant set bit and is bounded by the width of the argument.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    Version range not reported

  • Linux Linux

    2.6.36

  • KernelLinux

    From 2.6.36 · fixed in 5.10.265; From 5.11.0 · fixed in 5.15.216; From 5.16.0 · fixed in 6.6.148; From 6.7.0 · fixed in 6.12.101; From 6.13.0 · fixed in 6.18.42; From 6.19.0 · fixed in 7.1.6

References 8

git.kernel.org