CVE-2026-98545
Received Received - Intake

Buffer Overflow in Linux Kernel ATA Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and ata_scsi_set_passthru_sense_fields() trusts its additional length byte, sb[7], when adding the ATA Status Return descriptor. A faulty or malicious device can use that to make the kernel read and write past the 96-byte buffer in three ways: - scsi_sense_desc_find() is passed sb[7] + 8 as the buffer length, so its clamp against sb[7] does nothing and the walk runs off the end. - A type-9 descriptor found near the end is filled in unchecked. - A new descriptor at sb[8 + len] needs len + 22 bytes, not len + 14, so len 75..82 writes up to 8 bytes past the end. Reproduced with KASAN under qemu, with the emulated ATAPI REQUEST SENSE reply patched: BUG: KASAN: slab-out-of-bounds in scsi_sense_desc_find+0x1a5/0x210 BUG: KASAN: slab-out-of-bounds in ata_scsi_qc_complete+0x1a15/0x1a50 Both are gone with this patch, and a valid descriptor is still filled in.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98545
EUVD
EUVD-2026-103590

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux ce477199c53e3db5a096981c565e232498ddeae4
Linux Linux 97981926224afe17ba3e22e0c2b7dd8b516ee574
Linux Linux 97981926224afe17ba3e22e0c2b7dd8b516ee574
Linux Linux 97981926224afe17ba3e22e0c2b7dd8b516ee574
Linux Linux 97981926224afe17ba3e22e0c2b7dd8b516ee574
Linux Linux 67d9d0b6ae4aaf2c4cef103a96a145c7fdfb15f8
Linux Linux 6.6.44
Linux Linux 6.10.3
Linux Linux 6.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a buffer overflow in the ATA passthrough sense descriptor handling. When an ATA PASS-THROUGH command fails on an ATAPI device, the kernel incorrectly trusts the sense buffer's length byte, allowing a faulty or malicious device to write beyond the allocated 96-byte buffer. This can lead to memory corruption and crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's ATA passthrough handling and requires kernel-level detection. Monitor kernel logs for slab-out-of-bounds errors or KASAN reports related to scsi_sense_desc_find or ata_scsi_qc_complete. Use commands like dmesg | grep -i kasan or journalctl -k | grep -i slab-out-of-bounds to check for such errors.

Impact Analysis

This vulnerability could allow an attacker with access to a vulnerable system to cause a denial of service by crashing the kernel. It may also enable further exploitation if combined with other vulnerabilities, potentially leading to unauthorized access or data leaks.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Update your system using your package manager (e.g., apt upgrade linux-image-generic or yum update kernel). Reboot the system after applying the patch to ensure the updated kernel is active.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98545. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart