CVE-2026-23355: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23355 is a Linux kernel vulnerability in the ata: libata subsystem, specifically in the ATA SCSI deferred queue command (QC) work handling. The flaw arises because pending work is not properly canceled after clearing ap->deferred_qc, leading to a race condition that can trigger a WARN_ON() in ata_scsi_deferred_qc_work() and cause system instability. It was disclosed on March 25, 2026, and affects Linux kernel versions 6.18.14–6.18.18, 6.19.4–6.19.7, 7.0-rc1, and 7.0-rc2. The CVSS v3.1 base score is 5.5 (Medium), exploitable locally by a low-privileged user (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-459 (Incomplete Cleanup): when ap->deferred_qc is cleared during a timeout or error condition, the associated scheduled work item is not canceled. This creates a race condition where stale work — originally queued for a previous non-NCQ command — executes after a port reset when new NCQ and non-NCQ commands have already been queued, causing the WARN_ON() assertion in ata_scsi_deferred_qc_work() to fire because ap->ops->qc_defer() returns non-zero at that point. The attack vector is local, requiring low privileges and no user interaction. The fix ensures that cancel_work() is called while holding ap->lock whenever ap->deferred_qc is cleared, preventing the stale work from executing (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation can cause a denial of service through kernel warnings (WARN_ON()) and ATA device operation disruption, potentially destabilizing the affected system. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Systems relying on ATA storage devices are most at risk, as disruption to the libata subsystem can impair storage I/O operations (Red Hat CVE, Red Hat Bugzilla).

Patches are available in the Linux kernel stable tree targeting the affected version ranges (6.18.14–6.18.18 fixed before 6.18.18; 6.19.4–6.19.7 fixed before 6.19.7). Multiple upstream commits address the issue: 0d12453818c3, 58e658763ba2, 6c5e8f16b5e8, and aac9b27f7c1f (Kernel Patches). Amazon Linux 2023 has issued an advisory (ALAS2023-2026-1596). As a workaround where patching is not immediately possible, restricting local user privileges and monitoring ATA-related kernel warnings in system logs can reduce risk (Red Hat CVE).