The Linux kernel’s ATA driver for the DWC‑460ex SATA controller contains an infinite loop bug in the NCQ tag completion bit‑scanning routine. When the tag mask contains only high‑order bits (e.g., 0x80000000), the loop left‑shifts the mask until it overflows to zero. From that point, the condition never fails, keeping the kernel in a hard‑interrupt context while a spinlock is held. This causes the kernel to hang, resulting in a denial of service or potential crash.

Linux kernel builds that include the ata driver for the DWC‑460ex SATA controller. No specific version range is listed in the CVE data; any kernel employing that driver is potentially affected.

The CVSS score is 5.5, but the EPSS score is below 1 % and the vulnerability is not yet listed in CISA’s KEV catalog, indicating a low exploitation probability. The attack vector is not explicitly documented; it is inferred that an attacker would need local access to trigger the specific SATA command pattern that sets the tag mask with high bits, which typically requires privileged or physical access to the host system. Once triggered, the vulnerable code will cause a kernel panic or stall, denying service to all users.