Description
In the Linux kernel, the following vulnerability has been resolved:

ata: libata-scsi: bound the ATA passthru sense descriptor writes

When an ATA PASS-THROUGH command to an ATAPI device fails, the sense
buffer holds the device's REQUEST SENSE reply, and
ata_scsi_set_passthru_sense_fields() trusts its additional length
byte, sb[7], when adding the ATA Status Return descriptor. A faulty
or malicious device can use that to make the kernel read and write
past the 96-byte buffer in three ways:

- scsi_sense_desc_find() is passed sb[7] + 8 as the buffer length, so
its clamp against sb[7] does nothing and the walk runs off the end.
- A type-9 descriptor found near the end is filled in unchecked.
- A new descriptor at sb[8 + len] needs len + 22 bytes, not len + 14,
so len 75..82 writes up to 8 bytes past the end.

Reproduced with KASAN under qemu, with the emulated ATAPI REQUEST SENSE
reply patched:

BUG: KASAN: slab-out-of-bounds in scsi_sense_desc_find+0x1a5/0x210
BUG: KASAN: slab-out-of-bounds in ata_scsi_qc_complete+0x1a15/0x1a50

Both are gone with this patch, and a valid descriptor is still filled
in.
Published: 2026-10-18
Score: n/a
EPSS: n/a
KEV: No
Impact: Kernel memory corruption potentially leading to privilege escalation or service disruption
Action: Patch immediately
AI Analysis

Impact

A bug in the Linux kernel’s ATA passthrough handling allows an ATAPI device to supply a malformed REQUEST SENSE reply that causes the kernel to trust an invalid length byte. This trust leads to a heap-based buffer overflow as the kernel writes beyond a 96‑byte buffer during sense descriptor processing. The overflow can corrupt kernel memory, creating a path for arbitrary code execution or kernel crash.

Affected Systems

All Linux kernel releases prior to the inclusion of the referenced patch commit. The vulnerability affects the libata-scsi module that processes ATA passthrough commands to ATAPI devices. Any distribution shipping those kernel versions is potentially impacted.

Risk and Exploitability

The flaw provides an out‑of‑bounds write that can be triggered via a malicious ATAPI device. While no EPSS score and KEV listing are available, the nature of the bug and its location in kernel code make it a high‑risk issue capable of privilege escalation. Attackers would need access to the ATA interface and a crafted device; once triggered, the kernel may crash or execute arbitrary code.

Generated by OpenCVE AI on October 18, 2026 at 17:19 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that incorporates the libata-scsi patch
  • If a kernel update is not immediately feasible, disable or restrict ATA passthrough functionality to trusted devices only
  • Monitor system logs for signs of KASAN warnings or unexpected kernel panics indicative of memory corruption

Generated by OpenCVE AI on October 18, 2026 at 17:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 18 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122
CWE-787

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and ata_scsi_set_passthru_sense_fields() trusts its additional length byte, sb[7], when adding the ATA Status Return descriptor. A faulty or malicious device can use that to make the kernel read and write past the 96-byte buffer in three ways: - scsi_sense_desc_find() is passed sb[7] + 8 as the buffer length, so its clamp against sb[7] does nothing and the walk runs off the end. - A type-9 descriptor found near the end is filled in unchecked. - A new descriptor at sb[8 + len] needs len + 22 bytes, not len + 14, so len 75..82 writes up to 8 bytes past the end. Reproduced with KASAN under qemu, with the emulated ATAPI REQUEST SENSE reply patched: BUG: KASAN: slab-out-of-bounds in scsi_sense_desc_find+0x1a5/0x210 BUG: KASAN: slab-out-of-bounds in ata_scsi_qc_complete+0x1a15/0x1a50 Both are gone with this patch, and a valid descriptor is still filled in.
Title ata: libata-scsi: bound the ATA passthru sense descriptor writes
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:18:13.949Z

Reserved: 2026-09-25T10:25:14.356Z

Link: CVE-2026-98545

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:06.403

Modified: 2026-10-18T16:17:06.403

Link: CVE-2026-98545

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T17:30:16Z

Weaknesses