CVE-2026-45855
It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505) It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518) It was discovered that some AMD Zen 5 processors supporting RDSEED instruction did not properly handle entropy, potentially resulting in the consumption of insufficiently random values. A local attacker could possibly use this issue to influence the values returned by the RDSEED instruction causing loss of confidentiality and integrity. (CVE-2025-62626) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - Compute Acceleration Framework; - ACPI drivers; - Serial ATA and Parallel ATA drivers; - ATM drivers; - Drivers core; - Power management core; - DRBD Distributed Replicated Block Device drivers; - Rados block device (RBD) driver; - RNBD block device driver; - Ublk userspace block driver; - Compressed RAM block device driver; - Bluetooth drivers; - Bus devices; - Character device driver; - TPM device driver; - Clock framework and drivers; - Clocksource drivers; - Data acquisition framework and drivers; - Counter interface drivers; - CPU frequency scaling framework; - CPU idle management framework; - Hardware crypto device drivers; - CXL (Compute Express Link) drivers; - DMA engine subsystem; - EDAC drivers; - EFI core; - GPIO subsystem; - GPU drivers; - Greybus drivers; - HID subsy
CSIRTS triage
- What
- A command starvation vulnerability in the libata-scsi layer where NCQ commands can block non-NCQ commands indefinitely, causing I/O hangs.
- Who is affected
- Systems using SATA/SAS controllers with NCQ support under heavy mixed workloads.
- Urgency
- Medium; CVSS 5.5 indicates denial-of-service risk but requires specific workload conditions.
- Action
- Update to a patched Linux kernel version with proper NCQ/non-NCQ command scheduling fairness in libata-scsi.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-45855
Get an email if CVE-2026-45855 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 6% of all EPSS-scored CVEs.
Advisory coverage (14)
- mediumCVE-2026-45855: ata: libata-scsi: avoid Non-NCQ command starvationmsrc · 2026-08-06
- highUSN-8619-1: Linux kernel (HWE) vulnerabilitiesubuntu · 2026-07-28
- highUSN-8595-3: Linux kernel (AWS) vulnerabilitiesubuntu · 2026-07-28
- highUSN-8574-3: Linux kernel vulnerabilitiesubuntu · 2026-07-28
- highUSN-8609-1: Linux kernel (Azure CVM) vulnerabilitiesubuntu · 2026-07-24
- highUSN-8608-1: Linux kernel (Azure FIPS) vulnerabilitiesubuntu · 2026-07-24
- highUSN-8607-1: Linux kernel (Azure CVM) vulnerabilitiesubuntu · 2026-07-24
- highUSN-8606-1: Linux kernel (Azure) vulnerabilitiesubuntu · 2026-07-24
- highUSN-8595-2: Linux kernel (AWS) vulnerabilitiesubuntu · 2026-07-24
- highUSN-8596-1: Linux kernel (NVIDIA) vulnerabilitiesubuntu · 2026-07-23
- highUSN-8595-1: Linux kernel (Oracle) vulnerabilitiesubuntu · 2026-07-23
- highUSN-8574-2: Linux kernel vulnerabilitiesubuntu · 2026-07-23
- highUSN-8574-1: Linux kernel (GCP FIPS) vulnerabilitiesubuntu · 2026-07-21
- highUSN-8567-1: Linux kernel vulnerabilitiesubuntu · 2026-07-20
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-45855)