ata: libata-scsi: bound the ATA passthru sense descriptor writes
Summary
| CVE | CVE-2026-98545 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-10-18 16:17:06 UTC |
|---|
| Updated | 2026-10-18 16:17:06 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
ata: libata-scsi: bound the ATA passthru sense descriptor writes
When an ATA PASS-THROUGH command to an ATAPI device fails, the sense
buffer holds the device's REQUEST SENSE reply, and
ata_scsi_set_passthru_sense_fields() trusts its additional length
byte, sb[7], when adding the ATA Status Return descriptor. A faulty
or malicious device can use that to make the kernel read and write
past the 96-byte buffer in three ways:
- scsi_sense_desc_find() is passed sb[7] + 8 as the buffer length, so
its clamp against sb[7] does nothing and the walk runs off the end.
- A type-9 descriptor found near the end is filled in unchecked.
- A new descriptor at sb[8 + len] needs len + 22 bytes, not len + 14,
so len 75..82 writes up to 8 bytes past the end.
Reproduced with KASAN under qemu, with the emulated ATAPI REQUEST SENSE
reply patched:
BUG: KASAN: slab-out-of-bounds in scsi_sense_desc_find+0x1a5/0x210
BUG: KASAN: slab-out-of-bounds in ata_scsi_qc_complete+0x1a15/0x1a50
Both are gone with this patch, and a valid descriptor is still filled
in. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected ce477199c53e3db5a096981c565e232498ddeae4 c698f6deabf680f8f4a1727ef2dc80fe78815fbf git |
Not specified |
| CNA |
Linux |
Linux |
affected 97981926224afe17ba3e22e0c2b7dd8b516ee574 d9a7147b93624660626cd7c3b1143715699e1f5c git |
Not specified |
| CNA |
Linux |
Linux |
affected 97981926224afe17ba3e22e0c2b7dd8b516ee574 1603abb0c50420e97cf4a1feddbd5e183c5fdf86 git |
Not specified |
| CNA |
Linux |
Linux |
affected 97981926224afe17ba3e22e0c2b7dd8b516ee574 80fbb0bc4d11683c88f2f9d3997ea02fcada5408 git |
Not specified |
| CNA |
Linux |
Linux |
affected 97981926224afe17ba3e22e0c2b7dd8b516ee574 80320b278fea07ffcda3f57b67b61658e0a4e1ca git |
Not specified |
| CNA |
Linux |
Linux |
affected 67d9d0b6ae4aaf2c4cef103a96a145c7fdfb15f8 git |
Not specified |
| CNA |
Linux |
Linux |
affected 6.6.44 6.6.158 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.10.3 6.11 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.11 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.11 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.158 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.112 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.55 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.9 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/80320b278fea07ffcda3f57b67b61658e0a4e1ca |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/1603abb0c50420e97cf4a1feddbd5e183c5fdf86 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/80fbb0bc4d11683c88f2f9d3997ea02fcada5408 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/c698f6deabf680f8f4a1727ef2dc80fe78815fbf |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/d9a7147b93624660626cd7c3b1143715699e1f5c |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.