CVE-2026-89586
Description
A flaw was found in the Linux kernel's libata-scsi component. This vulnerability occurs when the system attempts to perform Data Set Management (DSM) TRIM operations on storage devices with logical sector sizes exceeding 2048 bytes. Due to an incorrect handling of the TRIM descriptor generation, these operations are rejected. This prevents the efficient reclamation of storage space, leading to a denial of service for the TRIM functionality on affected devices.
Statement
A low-impact functional flaw in the Linux kernel's libata-scsi subsystem affects the kernels shipped in Red Hat Enterprise Linux 8, 9, and 10 and the Red Hat Enterprise Linux CoreOS kernels used by Red Hat OpenShift Container Platform. When the kernel translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT (DSM) TRIM command on a storage device whose logical sector size is larger than 2048 bytes (for example, a 4Kn drive), the TRIM descriptor generated by ata_format_dsm_trim_descr() is clamped to the 2048-byte ata_scsi_rbuf staging buffer, while the caller compares the returned size against the device's logical sector size. This comparison always fails on such devices, so every TRIM request is rejected with a parameter list length error, accompanied by WARN_ON() splats, and TRIM/discard is completely non-functional. The issue is local to the storage subsystem and affects only the availability of the discard feature on large-sector ATA devices; there is no impact on confidentiality or integrity, and devices with smaller logical sector sizes (such as common 512-byte-sector drives) are unaffected. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present, and Red Hat Enterprise Linux 6 is out of support scope. Fixes for the affected streams are deferred because this is a low-impact functional failure rather than an exploitable security vulnerability; the residual risk is the continued loss of TRIM/discard support on affected large-sector devices, preventing efficient reclamation of storage space. The severity assigned by CVEORG (8.2, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) is not considered accurate for this flaw, as it is not remotely exploitable and is limited to local TRIM processing; Red Hat rates it low impact with a CVSS 3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 8.2 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
