CVE-2026-23355: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23355 is a Linux kernel vulnerability in the ata: libata subsystem, specifically in the ATA SCSI deferred queue command (QC) work handling. The flaw arises because pending work is not properly canceled after clearing ap->deferred_qc, leading to a race condition that can trigger a WARN_ON() in ata_scsi_deferred_qc_work() and cause system instability. It was disclosed on March 25, 2026, and affects Linux kernel versions 6.18.14–6.18.18, 6.19.4–6.19.7, 7.0-rc1, and 7.0-rc2. The CVSS v3.1 base score is 5.5 (Medium), exploitable locally by a low-privileged user (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-459 (Incomplete Cleanup): when ap->deferred_qc is cleared during a timeout or error condition, the associated scheduled work item is not canceled. This creates a race condition where stale work — originally queued for a previous non-NCQ command — executes after a port reset when new NCQ and non-NCQ commands have already been queued, causing the WARN_ON() assertion in ata_scsi_deferred_qc_work() to fire because ap->ops->qc_defer() returns non-zero at that point. The attack vector is local, requiring low privileges and no user interaction. The fix ensures that cancel_work() is called while holding ap->lock whenever ap->deferred_qc is cleared, preventing the stale work from executing (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation can cause a denial of service through kernel warnings (WARN_ON()) and ATA device operation disruption, potentially destabilizing the affected system. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Systems relying on ATA storage devices are most at risk, as disruption to the libata subsystem can impair storage I/O operations (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability was originally reported to the kernel via Syzbot (a kernel fuzzing tool), indicating it was discovered through automated testing rather than active threat actor activity. The EPSS score is approximately 0.018%, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE, Red Hat Bugzilla).

Patches are available in the Linux kernel stable tree targeting the affected version ranges (6.18.14–6.18.18 fixed before 6.18.18; 6.19.4–6.19.7 fixed before 6.19.7). Multiple upstream commits address the issue: 0d12453818c3, 58e658763ba2, 6c5e8f16b5e8, and aac9b27f7c1f (Kernel Patches). Amazon Linux 2023 has issued an advisory (ALAS2023-2026-1596). As a workaround where patching is not immediately possible, restricting local user privileges and monitoring ATA-related kernel warnings in system logs can reduce risk (Red Hat CVE).