The Linux kernel driver for ATA devices was missing a quirk needed for the PNY CS900 1TB SSD. When the storage controller entered a device‑initiated slumber state, the drive dropped off the SATA bus and the link could not recover. The kernel set the link status to down, forcing the mounted file system to become read‑only, which effectively halted I/O operations. This is a purely availability problem; it does not provide privilege escalation, data confidentiality loss, or code execution. The weakness can be mapped to improper handling of a device state change, leading to denial of service.

All Linux kernel configurations that use the default 'med_power_with_dipm' policy and that contain the affected libata-core code are susceptible. The issue appears on every kernel until a later patch that introduces a NOLPM quirk for PNY CS900 drives. Any system that relies on the PNY CS900 1TB SSD and does not disable link power management is potentially impacted. There is no vendor‑specific product other than the Linux kernel itself.

The CVSS score is 5.5, but the problem is a local denial of service that requires the target to idle the drive long enough for the state transition to occur. The EPSS score is <1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Consequently, the likelihood of exploitation is low, and there are no known active exploitation mechanisms. A typical attacker would need physical or root‑level influence to cause the drive to enter slumber, so the attack vector is inferred to be local.