Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-18T00:00:00 kernel: ata: libata-scsi: bound the ATA passthru sense descriptor writes 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-787

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and ata_scsi_set_passthru_sense_fields() trusts its additional length byte, sb[7], when adding the ATA Status Return descriptor. A faulty or malicious device can use that to make the kernel read and write past the 96-byte buffer in three ways: - scsi_sense_desc_find() is passed sb[7] + 8 as the buffer length, so its clamp against sb[7] does nothing and the walk runs off the end. - A type-9 descriptor found near the end is filled in unchecked. - A new descriptor at sb[8 + len] needs len + 22 bytes, not len + 14, so len 75..82 writes up to 8 bytes past the end. Reproduced with KASAN under qemu, with the emulated ATAPI REQUEST SENSE reply patched: BUG: KASAN: slab-out-of-bounds in scsi_sense_desc_find+0x1a5/0x210 BUG: KASAN: slab-out-of-bounds in ata_scsi_qc_complete+0x1a15/0x1a50 Both are gone with this patch, and a valid descriptor is still filled in.

A flaw was found in the Linux kernel's libata SCSI subsystem. When processing ATA pass-through commands to an ATAPI storage device, the kernel fails to properly validate the length byte returned in the device's sense response buffer. A malicious or faulty device can exploit this issue to trigger out-of-bounds memory reads and writes, leading to memory corruption, system instability, or a Denial of Service (DoS).

Red Hat has rated this vulnerability as having Moderate severity because successful exploitation requires either physical access to attach a crafted ATAPI storage device or administrative control over an emulated drive in virtualized deployments. The scope of impact is limited to local memory corruption causing system instability or denial of service, with no capability for remote exploitation. In addition, default deployments of Red Hat Enterprise Linux 8 and 9 do not contain the affected code. Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 Not affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-98545 https://nvd.nist.gov/vuln/detail/CVE-2026-98545 https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98545.mbox