CVE-2026-89586

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes

ata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the

UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM

descriptor is built by ata_format_dsm_trim_descr() into the 2048-byte

ata_scsi_rbuf staging buffer, and the number of bytes copied is compared

against the logical sector size by the caller:

size = ata_format_dsm_trim_descr(scmd, trmax, block, n_block);

if (size != len) /* len == sdp->sector_size */

goto invalid_param_len;

ata_format_dsm_trim_descr() clamps the copy length to ATA_SCSI_RBUF_SIZE

(2048). On a device whose logical sector size exceeds that (e.g. a 4Kn

device, where sector_size == 4096) the function can never return more than

2048, while the caller expects it to return sector_size. The comparison

therefore always fails, so every TRIM is rejected with "Parameter list

length error" and WAR

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References