All vulnerabilities
CVE-2026-97441

Linux: ata: ahci: fail probe if BAR too small for claimed ports

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in533a08ea11217100cec7a0ed903cb9b9c892d6f1Also 6d29b91164424256a759ddabc8f2de1ae09bd3f1CVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 533a08ea11217100cec7a0ed903cb9b9c892d6f1LinuxCVE List
  • 6d29b91164424256a759ddabc8f2de1ae09bd3f1LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ata: ahci: fail probe if BAR too small for claimed ports

When an AHCI controller is disabled in BIOS, its HOST_CAP register may contain a bogus value, e.g. 0xFFFFFFFF.

Since CAP.NP (Number of Ports) is a zeroes based 5-bit register field, a value of 0x1f means 32 ports. If CAP.NP claims more ports than can physically fit within the mapped BAR region, accessing port registers beyond the BAR boundary causes a kernel panic.

Add validation in ahci_init_one() to check that the BAR size is sufficient for the number of ports claimed in CAP.NP. The check calculates the required MMIO size as:

required_size = 0x100 (global registers) + max_ports * 0x80

If required_size exceeds the actual BAR size, the probe fails with -ENODEV, preventing the panic and providing a clear error message.

[cassel: commit log]

Text from CVE List

Affected versions 16

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 533a08ea11217100cec7a0ed903cb9b9c892d6f1CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c717b20100ef8cd06b5237af70ea2cb692e058ceCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before ff0ab535f8febbd32afa5832f8d2d9b06a8d5060CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 6d29b91164424256a759ddabc8f2de1ae09bd3f1CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before df262c828b616450eb351349e91c63447551bd01CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f2e291043c37a896d7f9797e25a356dceb030177CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c4086c6e1af757e1ff26fa2d2926b3ec0195de79CVE List
  • Linuxaffected: 2.6.12CVE List
  • Linuxunaffected: all versions before 2.6.12CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 7