CVE-2026-98262

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY A user reported that commit 105c42566a55 ("ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585") made the JMicron JMB585 unusable on his board. The failure is seen as soon as the ahci driver is probed, and booting with iommu=off does not solve the problem. Looking at the AHCI specification, PxCLBU and PxFBU are both read only '0' for HBAs that do not support 64-bit addressing. For HBAs that do support 64-bit addressing, the registers are read write, with a reset value that is Implementation Specific. When using the AHCI_HFLAG_32BIT_ONLY flag, the HBA does support 64-bit addressing, and a 32-bit DMA mask is set by simply clearing HOST_CAP_64. Thus, in this case, we need to explicitly clear the registers to 0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98262

EUVD

EUVD-2026-93190

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c
Linux	Linux	c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c
Linux	Linux	c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c
Linux	Linux	c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c
Linux	Linux	c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c
Linux	Linux	c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c
Linux	Linux	c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c
Linux	Linux	c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c
Linux	Linux	2.6.22

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the AHCI driver for SATA controllers. When the AHCI_HFLAG_32BIT_ONLY flag is used, the driver incorrectly leaves certain registers (PxCLBU and PxFBU) in an undefined state. These registers should be explicitly cleared to zero for controllers that only support 32-bit DMA addressing, which prevents hardware initialization failures.

Detection Guidance

This vulnerability is specific to the Linux kernel's AHCI driver and affects systems using JMicron JMB582/JMB585 controllers. Detection involves checking kernel logs for AHCI driver probe failures or issues with 32-bit DMA masking. Use commands like dmesg | grep ahci or journalctl -k | grep ahci to review AHCI-related errors.

Impact Analysis

This vulnerability can cause SATA controllers, specifically JMicron JMB585, to fail during system boot. The affected hardware becomes unusable, leading to potential data access issues or system instability if the controller is required for storage devices.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a hardware-level driver issue in the Linux kernel. Compliance impacts would only occur if the vulnerability led to data breaches or unauthorized access, which is not indicated here.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this issue. If immediate update is not possible, avoid using the AHCI_HFLAG_32BIT_ONLY flag for affected controllers or disable the JMicron JMB585 controller in BIOS/UEFI settings if not required.

Hi! I’m here to help you understand CVE-2026-98262. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70