Linux Kernel Vulnerability in SATA DWC 460EX Affects Performance and Stability

CVE-2026-68449

What is CVE-2026-68449?

A vulnerability has been identified in the Linux kernel related to the SATA DWC 460EX component. This issue arises from a hand-rolled bit-scanning loop in the NCQ tag completion path, which can result in an infinite loop when the tag_mask contains only high bits set, such as 0x80000000. As the inner loop continues to left-shift tag_mask, it eventually overflows to zero, causing the loop condition to perpetually evaluate to true. This situation can lead to system hangs while holding a spinlock, critically affecting system performance and stability. The recommended fix replaces the open-coded bit-scanning logic with a safer implementation using __ffs(), which accurately identifies the least significant set bit and is constrained by the width of the argument, thereby mitigating the looping problem.

References