CVE-2026-98545

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-scsi: bound the ATA passthru sense descriptor writes

When an ATA PASS-THROUGH command to an ATAPI device fails, the sense

buffer holds the device's REQUEST SENSE reply, and

ata_scsi_set_passthru_sense_fields() trusts its additional length

byte, sb[7], when adding the ATA Status Return descriptor. A faulty

or malicious device can use that to make the kernel read and write

past the 96-byte buffer in three ways:

- scsi_sense_desc_find() is passed sb[7] + 8 as the buffer length, so

its clamp against sb[7] does nothing and the walk runs off the end.

- A type-9 descriptor found near the end is filled in unchecked.

- A new descriptor at sb[8 + len] needs len + 22 bytes, not len + 14,

so len 75..82 writes up to 8 bytes past the end.

Reproduced with KASAN under qemu, with the emulated ATAPI REQUEST SENSE

reply patched:

BUG: KASAN: slab-out-of-bounds in scsi_sense_desc_find+0x1a5/0x210

BUG: KASAN: slab-

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References