The vulnerability lies in the Linux kernel’s libata-scsi subsystem, where non-Name-Concatenated Queue (Non-NCQ) commands can be repeatedly deferred when a host adapter is busy with many NCQ commands. Because the SCSI and block layers treat all commands the same, the system may requeue non-NCQ commands many times, leading to extensive delays or complete starvation of these commands. This starvation can block I/O operations from the device, resulting in a denial‑of‑service condition for clients that rely on timely responses from the SCSI device. The impact is limited to availability; confidentiality or integrity are not directly affected. The primary weakness is an uncontrolled resource consumption scenario that allows an attacker to induce long queue waits or starve non‑NCQ commands.

Any Linux system running a kernel version prior to the inclusion of the described patch is affected. The affected code resides in the libata-scsi component of the Linux kernel. No specific product versions are listed, so the vulnerability applies to all kernel releases that have not integrated the new forward‑progress guarantee for non‑NCQ commands.

The vulnerability carries a moderate risk profile. The CVSS score is not publicly disclosed, and the EPSS score is unavailable, indicating no large body of exploitation evidence. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to be able to issue many non‑NCQ SCSI commands to a target device, which typically requires local or privileged access. Nevertheless, systems that constantly transfer large volumes of NCQ traffic could be unexpectedly degraded if an adversary amplifies non‑NCQ traffic to trigger prolonged starvation.