All vulnerabilities
CVE-2026-98545

Linux: ata: libata-scsi: bound the ATA passthru sense descriptor writes

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1603abb0c50420e97cf4a1feddbd5e183c5fdf86Also 80fbb0bc4d11683c88f2f9d3997ea02fcada5408, 80320b278fea07ffcda3f57b67b61658e0a4e1ca and 2 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-scsi: bound the ATA passthru sense descriptor writes

When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and ata_scsi_set_passthru_sense_fields() trusts its additional length byte, sb[7], when adding the ATA Status Return descriptor. A faulty or malicious device can use that to make the kernel read and write past the 96-byte buffer in three ways:

  • scsi_sense_desc_find() is passed sb[7] + 8 as the buffer length, so

its clamp against sb[7] does nothing and the walk runs off the end.

  • A type-9 descriptor found near the end is filled in unchecked.
  • A new descriptor at sb[8 + len] needs len + 22 bytes, not len + 14,

so len 75..82 writes up to 8 bytes past the end.

Reproduced with KASAN under qemu, with the emulated ATAPI REQUEST SENSE reply patched:

BUG: KASAN: slab-out-of-bounds in scsi_sense_desc_find+0x1a5/0x210 BUG: KASAN: slab-out-of-bounds in ata_scsi_qc_complete+0x1a15/0x1a50

Both are gone with this patch, and a valid descriptor is still filled in.

Text from CVE List

Affected versions 15

  • Linuxaffected: ce477199c53e3db5a096981c565e232498ddeae4 before c698f6deabf680f8f4a1727ef2dc80fe78815fbfCVE List
  • Linuxaffected: 97981926224afe17ba3e22e0c2b7dd8b516ee574 before d9a7147b93624660626cd7c3b1143715699e1f5cCVE List
  • Linuxaffected: 97981926224afe17ba3e22e0c2b7dd8b516ee574 before 1603abb0c50420e97cf4a1feddbd5e183c5fdf86CVE List
  • Linuxaffected: 97981926224afe17ba3e22e0c2b7dd8b516ee574 before 80fbb0bc4d11683c88f2f9d3997ea02fcada5408CVE List
  • Linuxaffected: 97981926224afe17ba3e22e0c2b7dd8b516ee574 before 80320b278fea07ffcda3f57b67b61658e0a4e1caCVE List
  • Linuxaffected: 67d9d0b6ae4aaf2c4cef103a96a145c7fdfb15f8CVE List
  • Linuxaffected: 6.6.44 before 6.6.158CVE List
  • Linuxaffected: 6.10.3 before 6.11CVE List
  • Linuxaffected: 6.11CVE List
  • Linuxunaffected: all versions before 6.11CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5