In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes… (CVE-2026-89586)
A vulnerability in the Linux kernel's ATA SCSI driver caused TRIM commands to fail on devices with logical sector sizes larger than 2048 bytes, such as 4Kn drives. The issue was due to incorrect sizing of the TRIM descriptor buffer, which was fixed by adjusting the descriptor to a fixed 512-byte page size independent of sector size. This resolves the problem where TRIM commands were rejected with parameter errors and prevented proper discard operations on affected devices.
AI Analysis
Technical Summary
The Linux kernel's ata_scsi_write_same_xlat() function translates SCSI WRITE SAME commands with the UNMAP bit into ATA DATA SET MANAGEMENT TRIM commands. The TRIM descriptor was built into a 2048-byte buffer, but on devices with logical sector sizes larger than 2048 bytes (e.g., 4096 bytes for 4Kn devices), the function ata_format_dsm_trim_descr() would clamp the copy length to 2048 bytes, causing a mismatch with the expected sector size. This mismatch caused all TRIM commands to fail with a "Parameter list length error" and triggered warnings. The root cause was that the TRIM payload should be sized as a fixed 512-byte page independent of logical sector size. The fix emits exactly one 512-byte page and transfers only that page, allowing TRIM to work correctly on devices with larger sector sizes.
Potential Impact
Devices with logical sector sizes larger than 2048 bytes were unable to successfully perform TRIM/discard operations due to the Linux kernel rejecting these commands with parameter errors. This could lead to degraded storage performance or increased wear on SSDs that rely on TRIM for efficient garbage collection. The issue did not affect devices with 512-byte sectors and did not cause data corruption but prevented proper discard functionality.
Mitigation Recommendations
A fix is available in the Linux kernel that corrects the TRIM descriptor sizing to a fixed 512-byte page independent of logical sector size, resolving the failure of TRIM commands on devices with larger sector sizes. Users should apply the updated kernel version containing this fix to restore proper TRIM functionality. No additional mitigations are necessary once the patch is applied.
In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes… (CVE-2026-89586)
Description
A vulnerability in the Linux kernel's ATA SCSI driver caused TRIM commands to fail on devices with logical sector sizes larger than 2048 bytes, such as 4Kn drives. The issue was due to incorrect sizing of the TRIM descriptor buffer, which was fixed by adjusting the descriptor to a fixed 512-byte page size independent of sector size. This resolves the problem where TRIM commands were rejected with parameter errors and prevented proper discard operations on affected devices.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's ata_scsi_write_same_xlat() function translates SCSI WRITE SAME commands with the UNMAP bit into ATA DATA SET MANAGEMENT TRIM commands. The TRIM descriptor was built into a 2048-byte buffer, but on devices with logical sector sizes larger than 2048 bytes (e.g., 4096 bytes for 4Kn devices), the function ata_format_dsm_trim_descr() would clamp the copy length to 2048 bytes, causing a mismatch with the expected sector size. This mismatch caused all TRIM commands to fail with a "Parameter list length error" and triggered warnings. The root cause was that the TRIM payload should be sized as a fixed 512-byte page independent of logical sector size. The fix emits exactly one 512-byte page and transfers only that page, allowing TRIM to work correctly on devices with larger sector sizes.
Potential Impact
Devices with logical sector sizes larger than 2048 bytes were unable to successfully perform TRIM/discard operations due to the Linux kernel rejecting these commands with parameter errors. This could lead to degraded storage performance or increased wear on SSDs that rely on TRIM for efficient garbage collection. The issue did not affect devices with 512-byte sectors and did not cause data corruption but prevented proper discard functionality.
Mitigation Recommendations
A fix is available in the Linux kernel that corrects the TRIM descriptor sizing to a fixed 512-byte page independent of logical sector size, resolving the failure of TRIM commands on devices with larger sector sizes. Users should apply the updated kernel version containing this fix to restore proper TRIM functionality. No additional mitigations are necessary once the patch is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-4wqv-wrmf-6h4v
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89586"]
Threat ID: 6aa4a00d55bf5e2cf5a86689
Added to database: 09/12/2026, 00:42:53 UTC
Last enriched: 09/12/2026, 01:04:11 UTC
Last updated: 09/12/2026, 01:04:11 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.