{"id":"CVE-2026-98545","kind":"vulnerability","aliases":["CVE-2026-98545"],"related":[],"title":"Linux kernel: ATA passthru sense handling reads and writes past buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-scsi: bound the ATA passthru sense descriptor writes\n\nWhen an ATA PASS-THROUGH command to an ATAPI device fails, the sense\nbuffer holds the device's REQUEST SENSE reply, and\nata_scsi_set_passthru_sense_fields() trusts its additional length\nbyte, sb[7], when adding the ATA Status Return descriptor.  A faulty\nor malicious device can use that to make the kernel read and write\npast the 96-byte buffer in three ways:\n\n- scsi_sense_desc_find() is passed sb[7] + 8 as the buffer length, so\n  its clamp against sb[7] does nothing and the walk runs off the end.\n- A type-9 descriptor found near the end is filled in unchecked.\n- A new descriptor at sb[8 + len] needs len + 22 bytes, not len + 14,\n  so len 75..82 writes up to 8 bytes past the end.\n\nReproduced with KASAN under qemu, with the emulated ATAPI REQUEST SENSE\nreply patched:\n\n  BUG: KASAN: slab-out-of-bounds in scsi_sense_desc_find+0x1a5/0x210\n  BUG: KASAN: slab-out-of-bounds in ata_scsi_qc_complete+0x1a15/0x1a50\n\nBoth are gone with this patch, and a valid descriptor is still filled\nin.","summary":"The Linux kernel's libata SCSI code trusts a length byte from an ATAPI device's REQUEST SENSE reply when building ATA passthrough sense data, so a faulty or malicious device can cause out-of-bounds kernel memory reads and writes. The fix bounds those descriptor writes to the 96-byte sense buffer.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","libata","linux","self-hosted"],"not_affected_if":["no-ata-passthrough","no-atapi-devices"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it to the fixed kernel in the advisory\n- Confirm whether ATA passthrough to ATAPI devices is in use (for example, `smartctl` or `sg_raw` against optical or ATAPI devices)\n- unknown for an exact vulnerable version range, as the sources do not say","fix":"- Update the Linux kernel to a release that includes the libata-scsi fix for CVE-2026-98545 from your distribution or the stable kernel branch\n- unknown for the exact fixed version, as the sources do not say","status":"open","published_at":"2026-10-18T16:17:06+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:38+00:00","updated_at":"2026-10-25T05:23:38+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:23:38Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the libata-scsi fix for CVE-2026-98545 from your distribution or the stable kernel branch\n- unknown for the exact fixed version, as the sources do not say","reach":"local","title":"Linux kernel: ATA passthru sense handling reads and writes past buffer","impact":"high","summary":"The Linux kernel's libata SCSI code trusts a length byte from an ATAPI device's REQUEST SENSE reply when building ATA passthrough sense data, so a faulty or malicious device can cause out-of-bounds kernel memory reads and writes. The fix bounds those descriptor writes to the 96-byte sense buffer.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","libata","self-hosted"],"confidence":0.5,"needs_auth":"no","worst_case":"Kernel memory is read and written out of bounds from a malicious device","analyst_note":"Find the fixed kernel versions and distribution backports for CVE-2026-98545 in the upstream stable commit or the NVD entry, and confirm severity.","how_to_check":"- Check the running kernel version with `uname -r` and compare it to the fixed kernel in the advisory\n- Confirm whether ATA passthrough to ATAPI devices is in use (for example, `smartctl` or `sg_raw` against optical or ATAPI devices)\n- unknown for an exact vulnerable version range, as the sources do not say","needs_analyst":true,"not_affected_if":["no-atapi-devices","no-ata-passthrough"],"who_is_affected":"Systems running a Linux kernel with libata and ATAPI devices attached, where ATA PASS-THROUGH commands are issued. The flaw requires a faulty or malicious ATAPI device to supply the malformed sense reply, so hosts without ATAPI devices or ATA passthrough use are less exposed. unknown whether default configurations trigger the passthrough path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000729,"input_tokens":3706,"output_tokens":716,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':257C,271C '-2026':13A,16A '-9':196C '-98545':14A,17A '14':219C '22':215C '7':135C,173C,184C '75':222C '8':174C,211C,227C '82':223C '96':75B,160C 'add':137C 'addit':131C 'ata':3A,46B,89C,95C,102C,123C,139C,267C 'atapi':38B,109C,240C 'bound':61B,69B,93C,251C,265C 'buffer':11A,78B,114C,162C,177C 'bug':245C,259C 'build':45B 'byte':35B,76B,133C,161C,216C,228C 'caus':57B 'clamp':181C 'code':31B 'command':106C 'complet':270C 'cve':12A,15A 'data':49B 'desc':168C,255C 'descriptor':71B,98C,142C,197C,208C,282C 'devic':39B,55B,110C,117C,147C 'emul':239C 'end':193C,201C,231C 'fail':111C 'faulti':52B,144C 'field':128C 'fill':203C,285C 'find':169C,256C 'fix':68B 'follow':84C 'found':198C 'gone':275C 'handl':6A 'hold':115C 'host':24B 'infrastructur':18B 'kasan':234C,246C,260C 'kernel':2A,19B,27B,62B,82C,154C 'len':212C,214C,218C,221C 'length':34B,132C,178C 'libata':20B,29B,91C 'libata-scsi':90C 'linux':1A,21B,26B,81C 'make':152C 'malici':54B,146C 'memori':63B 'near':199C 'need':213C 'new':207C 'noth':186C 'out-of-bound':58B 'pass':104C,171C 'pass-through':103C 'passthrough':47B 'passthru':4A,96C,126C 'past':10A,158C,229C 'patch':244C,278C 'qc':269C 'qemu':236C 'read':7A,64B,155C 'repli':43B,121C,243C 'reproduc':232C 'request':41B,119C,241C 'resolv':88C 'return':141C 'run':190C 'sb':134C,172C,183C,210C 'scsi':30B,92C,124C,166C,253C,268C 'self':23B 'self-host':22B 'sens':5A,42B,48B,77B,97C,113C,120C,127C,167C,242C,254C 'set':125C 'slab':248C,262C 'slab-out-of-bound':247C,261C 'status':140C 'still':284C 'three':164C 'trust':32B,129C 'type':195C 'uncheck':205C 'use':149C 'valid':281C 'vulner':85C 'walk':189C 'way':165C 'write':9A,66B,72B,99C,157C,224C 'x1a15/0x1a50':272C 'x1a5/0x210':258C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with libata and ATAPI devices attached, where ATA PASS-THROUGH commands are issued. The flaw requires a faulty or malicious ATAPI device to supply the malformed sense reply, so hosts without ATAPI devices or ATA passthrough use are less exposed. unknown whether default configurations trigger the passthrough path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98545","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98545","severity":null,"published_at":"2026-10-18T16:17:06+00:00","modified_at":"2026-10-19T10:19:10+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}