CVE-2026-98545: ata: libata-scsi: bound the ATA passthru sense descriptor writes
ata: libata-scsi: bound the ATA passthru sense descriptor writes
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the Linux kernel are exposed when they issue ATA PASS-THROUGH commands to an ATAPI device. The vulnerable path is reached when that command fails and the device supplies a malformed or malicious REQUEST SENSE reply.
What does an attacker or faulty device need to control?
The device must be able to return a crafted ATAPI REQUEST SENSE response, including its additional-length byte or descriptor layout. Those values can cause the kernel to read or write beyond the 96-byte sense buffer.
How can I tell whether the vulnerable path has been triggered?
Kernel memory-safety instrumentation may report slab out-of-bounds errors involving scsi_sense_desc_find or ata_scsi_qc_complete. The issue was reproduced with KASAN using a modified emulated ATAPI REQUEST SENSE reply.