The flaw resides in the Linux kernel’s sata_dwc_460ex driver. During the probe of the SATA controller the driver enables interrupts before the corresponding IRQ handler has been registered. If the controller generates an interrupt at that stage, the kernel receives an interrupt with no handler, producing a spurious interrupt storm that consumes CPU cycles and degrades system responsiveness.

All Linux kernel releases that include the sata_dwc_460ex driver before the commit that moves sata_dwc_enable_interrupts() after ata_host_activate() are affected. Distributions shipping those kernels are at risk, especially systems that use the dwc SATA controller family.

The EPSS score is <1%, indicating a very low exploitation probability, and the CVSS score of 4.1 classifies the issue as Low severity. The vulnerability is local to the kernel and would require an adversary to influence the driver load during boot or otherwise trigger the probe sequence. Based on the description, it is inferred that an attacker with local access could attempt to provoke the interrupt storm by manipulating the driver initialization order. The risk is further limited by the lack of a CISA KEV listing.