CVE-2026-45855

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-scsi: avoid Non-NCQ command starvation

When a non-NCQ command is issued while NCQ commands are being executed, atascsiqcissue() indicates to the SCSI layer that the command issuing should be deferred by returning SCSIMLQUEUEXXXBUSY. This command deferring is correct and as mandated by the ACS specifications since NCQ and non-NCQ commands cannot be mixed.

However, in the case of a host adapter using multiple submission queues, when the target device is under a constant load of NCQ commands, there are no guarantees that requeueing the non-NCQ command will be executed later and it may be deferred again repeatedly as other submission queues can constantly issue NCQ commands from different CPUs ahead of the non-NCQ command. This can lead to very long delays for the execution of non-NCQ commands, and even complete starvation for these commands in the worst case scenario.

Since the block layer and the SCSI layer do not distinguish between queueable (NCQ) and non queueable (non-NCQ) commands, libata-scsi SAT implementation must ensure forward progress for non-NCQ commands in the presence of NCQ command traffic. This is similar to what SAS HBAs with a hardware/firmware based SAT implementation do.

Implement such forward progress guarantee by limiting requeueing of non-NCQ commands from atascsiqcissue(): when a non-NCQ command is received and NCQ commands are in-flight, do not force a requeue of the non-NCQ command by returning SCSIMLQUEUEXXXBUSY and instead return 0 to indicate that the command was accepted but hold on to the qc using the new deferredqc field of struct ataport.

This deferred qc will be issued using the work item deferredqcwork running the function atascsideferredqcwork() once all in-flight commands complete, which is checked with the port qcdefer() callback return value indicating that no further delay is necessary. This check is done using the helper function atascsischeduledeferredqc() which is called from atascsiqccomplete(). This thus excludes this mechanism from all internal non-NCQ commands issued by ATA EH.

When a port deferred_qc is non NULL, that is, the port has a command waiting for the device queue to drain, the issuing of all incoming commands (both NCQ and non-NCQ) is deferred using the regular busy mechanism. This simplifies the code and also avoids potential denial of service problems if a user issues too many non-NCQ commands.

Finally, whenever ata EH is scheduled, regardless of the reason, a deferred qc is always requeued so that it can be retried once EH completes. This is done by calling the function atascsirequeuedeferredqc() from ataehset_pending(). This avoids the need for any special processing for the deferred qc in case of NCQ error, link or device reset, or device timeout.