CVE-2026-72031

Received Received - Intake

ATA Link Power Management Bypass in PNY CS900 SSD

Publication date: 2026-08-15

Last updated on: 2026-08-18

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus after entering Device-Initiated Slumber during idle. With the default med_power_with_dipm policy the link goes down (SStatus 1 SControl 300) and does not recover, forcing the filesystem read-only. Forcing max_performance keeps the link stable across prolonged idle. Add a NOLPM quirk so link power management is disabled for this drive specifically, leaving it intact for other devices on the host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-18

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72031

EUVD

EUVD-2026-58989

Affected Vendors & Products

Vendor	Product	Version / Range
pny	cs900	From 1tb (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability affects the Linux kernel where the PNY CS900 1TB SSD (using Phison PS3111-S11 controller) drops off the system bus after entering a low-power state called Device-Initiated Slumber during idle. This causes the storage link to fail and forces the filesystem into a read-only state.

Detection Guidance

This vulnerability affects the PNY CS900 1TB SSD with Phison PS3111-S11 controller. Detection involves checking if the SSD is present and if it experiences link drops during idle. Commands like dmesg, smartctl -a /dev/sdX, or checking kernel logs for ata errors may help identify the issue.

Impact Analysis

If you use a PNY CS900 1TB SSD with the Linux kernel, your system may experience sudden storage disconnections during idle periods. This can lead to filesystem corruption, data loss, or system instability requiring a reboot to restore functionality.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The issue is specific to a hardware compatibility problem with a storage device in the Linux kernel, causing filesystem read-only states during idle periods. No data privacy or security implications are described.

Mitigation Strategies

To mitigate, disable link power management for the affected SSD by setting the drive to max_performance mode. This can be done via hdparm -B 255 /dev/sdX or adding a kernel quirk like the NOLPM quirk mentioned in the CVE. Ensure backups are current before making changes.

Hi! I’m here to help you understand CVE-2026-72031. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70