The vulnerability arises when a SATA device reports a concurrent positioning ranges count that exceeds the device’s own log size or the buffer allocated for the INQUIRY VPD B9h response. The Linux kernel’s libata-core module accepts this count without proper bounds checking and walks the descriptors at a fixed 32‑byte stride, leading to reads that can exceed a 512‑byte slab by up to 7,704 bytes and writes that can overflow a 2,048‑byte response buffer when the count is above 62. This unchecked reading and writing corrupts kernel memory, which could allow an attacker to cause a crash or hijack execution flow. The flaw is a classic heap‑based out‑of‑bounds read or write vulnerability as identified by CWE‑787.

All Linux kernel builds that compile the libata-core subsystem are potentially affected. No specific kernel version is indicated in the data, so any kernel that has not incorporated the patch outlined in the commit messages on 2026‑08‑15 should be considered vulnerable.

The CVSS score of 5.5 indicates a moderate severity. EPSS is <1 %, suggesting a low likelihood of widespread exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector involves a malicious or defective SATA device that supplies an exaggerated range count to the host; a local or physical attacker with control over the device can trigger the overflow. Because the bug occurs in kernel space, successful exploitation would grant elevated privileges, but the overall risk is tempered by the moderate severity rating and low exploit probability.