---
id: CVE-2026-68449
title: 'ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning

  The hand-rolled bit-scanning loop in the NCQ completion path has an
  infinite loop bug.  When …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 <
    ea9fa4dabe476f85fe73df30a6ab61a23c22fda4
  - >-
    Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 <
    d72e8089dc332ac48293512ef0de77cbe0e04d25
  - >-
    Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 <
    90e8cf489b593814b9398aa187ddbb790e33ec6f
  - >-
    Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 <
    4c6e64cae2b2dab32ad9099faa339f6a72c0ce16
  - >-
    Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 <
    8c5de0d8ab6824cfdadcbbe1be4c6c9d9f4c1f80
  - >-
    Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 <
    1842d45f461a78988254631893329bdf4596e954
  - >-
    Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 <
    29b916d3556bd12a95be7c56ca391b8cd572f8be
  - >-
    Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 <
    c2130f6553f4a5cbdc259de069600117a995f197
  - Linux 2.6.36
published: '2026-08-12'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:28:40.534Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68449'
references:
  - url: 'https://git.kernel.org/stable/c/ea9fa4dabe476f85fe73df30a6ab61a23c22fda4'
  - url: 'https://git.kernel.org/stable/c/d72e8089dc332ac48293512ef0de77cbe0e04d25'
  - url: 'https://git.kernel.org/stable/c/90e8cf489b593814b9398aa187ddbb790e33ec6f'
  - url: 'https://git.kernel.org/stable/c/4c6e64cae2b2dab32ad9099faa339f6a72c0ce16'
  - url: 'https://git.kernel.org/stable/c/8c5de0d8ab6824cfdadcbbe1be4c6c9d9f4c1f80'
  - url: 'https://git.kernel.org/stable/c/1842d45f461a78988254631893329bdf4596e954'
  - url: 'https://git.kernel.org/stable/c/29b916d3556bd12a95be7c56ca391b8cd572f8be'
  - url: 'https://git.kernel.org/stable/c/c2130f6553f4a5cbdc259de069600117a995f197'
tags:
  - cve.org
epss: 0.00165
epssPercentile: 0.05776
ingestedAt: '2026-11-05T15:02:32.466Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning

The hand-rolled bit-scanning loop in the NCQ completion path has an
infinite loop bug.  When tag_mask has only high bits set (e.g.
0x80000000), the inner while loop left-shifts tag_mask until it
overflows to 0.  At that point !(0 & 1) is always true and 0 <<= 1
stays 0, causing an infinite loop in hardirq context with a spinlock
held.

Replace the open-coded bit-scanning with __ffs() which correctly
finds the least significant set bit and is bounded by the width of
the argument.

## Affected

- `Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 < ea9fa4dabe476f85fe73df30a6ab61a23c22fda4`
- `Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 < d72e8089dc332ac48293512ef0de77cbe0e04d25`
- `Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 < 90e8cf489b593814b9398aa187ddbb790e33ec6f`
- `Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 < 4c6e64cae2b2dab32ad9099faa339f6a72c0ce16`
- `Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 < 8c5de0d8ab6824cfdadcbbe1be4c6c9d9f4c1f80`
- `Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 < 1842d45f461a78988254631893329bdf4596e954`
- `Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 < 29b916d3556bd12a95be7c56ca391b8cd572f8be`
- `Linux >= 62936009f35a6659cc3ebe0d90c754182d60da73 < c2130f6553f4a5cbdc259de069600117a995f197`
- `Linux 2.6.36`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.