The vulnerability involves the Linux kernel's handling of non-NCQ SCSI commands in the libata-scsi layer. When a non-NCQ command is issued amid active NCQ commands, the kernel defers the non-NCQ command by returning a busy status, as per ACS specifications. However, with multiple submission queues and constant NCQ command load, non-NCQ commands can be repeatedly deferred, causing starvation. The fix introduces a forward progress guarantee by limiting requeueing of non-NCQ commands and deferring their execution until the device queue drains, preventing indefinite starvation. This is managed via a deferred command queue and work items that retry the command once in-flight commands complete, ensuring eventual execution without denial of service.

The vulnerability can cause non-NCQ SCSI commands to experience very long delays or complete starvation under heavy NCQ command load in environments with multiple submission queues. This results in availability impact (denial of service) for non-NCQ commands. There is no impact on confidentiality or integrity. The severity is medium due to the potential for denial of service but no data compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates that a fix has been implemented in the Linux kernel to ensure forward progress of non-NCQ commands. Users should monitor official Linux kernel releases and apply updates that include this fix. No additional mitigation steps are described or required beyond applying the official fix when available.