In the Linux kernel, a flaw in libata causes pending work associated with a deferred queue command (QC) to remain scheduled even after the deferred QC has been cleared. When the scheduled work eventually runs, it may attempt to execute a command that no longer belongs to the original request. This mismatch can lead to incorrect command handling, unnecessary device resets, and the emission of WARN_ON messages, which may destabilize the storage subsystem and cause application failures.

The vulnerability affects the Linux kernel itself. All kernel builds released before the associated patch that fixes the deferred QC cancellation logic are susceptible, regardless of distribution or hardware configuration.

The CVSS score of 5.5 suggests moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, and the description indicates that exploitation would require a local privileged user capable of submitting SATA commands that trigger the deferred QC logic. Therefore, the risk is primarily limited to local or temporarily elevated privileges rather than remote attack vectors.