CVE-2026-98262
Description
A flaw was found in the Linux kernel's libahci driver. This issue can lead to a Denial of Service (DoS) when initializing storage controllers configured to use 32-bit Direct Memory Access (DMA). Because the driver fails to clear the upper 32-bit memory address registers on hardware that physically supports 64-bit addressing, uninitialized values remain in those registers. Consequently, a local user working with affected storage hardware may trigger device probe failures, rendering the storage controller and attached drives unusable.
Statement
This vulnerability is rated Moderate severity for Red Hat Enterprise Linux because exploitation is restricted to systems utilizing specific storage controller hardware and requires local interaction to trigger driver initialization failures. Standard enterprise installations typically deploy well-tested enterprise-grade host bus adapters or virtualized disk interfaces, meaning consumer-grade chipsets that enforce 32-bit addressing while possessing 64-bit capabilities are uncommon in production environments. Even when vulnerable host adapters are present, the defect manifests strictly as an operational failure during controller detection rather than leading to arbitrary code execution or privilege escalation.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
