In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA… (CVE-2026-98545)

The vulnerability in the Linux kernel's libata-scsi subsystem involved the function ata_scsi_set_passthru_sense_fields() trusting the additional length byte (sb[7]) in the sense buffer without proper bounds checking. This allowed a malicious or faulty ATAPI device to cause the kernel to read and write beyond the 96-byte sense buffer in multiple ways, including improper buffer length passed to scsi_sense_desc_find(), unchecked filling of a type-9 descriptor near the buffer end, and writing up to 8 bytes past the buffer end due to incorrect length calculations. The issue was reproduced using KASAN under qemu and was resolved by bounding the ATA passthru sense descriptor writes to prevent out-of-bounds access.

A malicious or faulty ATAPI device could exploit this vulnerability to cause out-of-bounds memory reads and writes in the kernel, potentially leading to kernel memory corruption or instability. The exact impact beyond memory corruption is not detailed in the provided information. No known exploits in the wild have been reported.

A patch has been applied to the Linux kernel to bound the ATA passthru sense descriptor writes and prevent out-of-bounds memory access. Users should update their Linux kernel to a version that includes this fix. Since no patch links or specific fixed versions are provided, users should consult the official Linux kernel advisories or maintainers for the exact fixed versions and apply the official update accordingly.