CVE-2026-43487: Linux Kernel libata-core DoS Vulnerability

CVE-2026-43487 Overview

CVE-2026-43487 affects the Linux kernel's libata-core subsystem. The flaw involves Link Power Management (LPM) interactions with the Seagate ST1000DM010-2EP102 hard drive. User reports indicate that enabling LPM on this drive causes random system freezes. The drive belongs to the same BarraCuda family as the ST2000DM008-2FR102, which exhibits identical behavior. Kernel maintainers resolved the issue by adding the drive to the LPM quirk list, disabling LPM for affected hardware. The issue produces availability impact rather than a security boundary violation.

Critical Impact

Systems using the affected Seagate BarraCuda drive can experience random freezes that interrupt service and require hard reboots, leading to unsaved data loss and potential filesystem corruption.

Affected Products

• Linux kernel versions prior to the commits referenced in the kernel.org stable tree
• Systems with Seagate ST1000DM010-2EP102 BarraCuda hard drives attached via SATA with LPM enabled
• Systems using ATA libata-core driver paths that negotiate aggressive link power states

Discovery Timeline

• 2026-05-13 - CVE-2026-43487 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-43487

Vulnerability Analysis

The defect resides in drivers/ata/libata-core.c, which manages SATA device negotiation, including Link Power Management states such as MIN_POWER and MED_POWER_WITH_DIPM. LPM allows SATA links to transition into reduced power states during idle periods. Some drive firmware does not handle these state transitions reliably. When the kernel issues LPM transitions to the ST1000DM010-2EP102, the drive can become unresponsive. The host controller then stalls waiting on I/O completion, and the resulting hang propagates to user space, freezing the system.

This issue mirrors the previously documented behavior of the ST2000DM008-2FR102 from the same BarraCuda product line. The kernel maintains a quirk table (ata_device_blacklist) used to disable problematic features on specific drive model strings. The fix adds the ST1000DM010-2EP102 model identifier to the table with the ATA_HORKAGE_NOLPM flag.

Root Cause

The root cause is missing hardware-specific compatibility data in the libata quirk list. The kernel assumed LPM compliance for the drive, but the device firmware fails to resume from low-power link states consistently. This is a hardware compatibility defect surfaced as a kernel availability bug rather than a memory safety issue.

Attack Vector

No remote or local attack vector applies. The condition triggers under normal idle workloads when LPM policies activate. An EPSS score near zero confirms the absence of exploitation interest. The impact is restricted to denial of service through system freeze on hosts running the affected drive.

No verified proof-of-concept code exists for this defect. The patch is a quirk-table addition rather than a logic change. See the kernel commits at git.kernel.org commit 87f0349b and git.kernel.org commit b3b1d3ae for the exact source modifications.

Detection Methods for CVE-2026-43487

Indicators of Compromise

• Unexplained system freezes on hosts equipped with Seagate ST1000DM010-2EP102 drives
• Kernel log entries referencing ata link timeouts, failed to IDENTIFY, or hung task warnings tied to the SATA controller
• dmesg output showing repeated LPM state transitions immediately before the freeze

Detection Strategies

• Inventory attached storage devices using lsblk -d -o NAME,MODEL or smartctl -i /dev/sdX and flag any host reporting the ST1000DM010-2EP102 model string
• Compare running kernel version against the fixed commits referenced in the kernel.org stable tree to confirm whether the quirk is present
• Review journalctl -k history for ATA error patterns correlated with system unresponsiveness events

Monitoring Recommendations

• Forward kernel ring buffer logs and SMART telemetry to a centralized log platform for trend analysis across the fleet
• Alert on ATA reset cycles, link power state errors, and hung task watchdog messages
• Track uptime regressions and unplanned reboots on hosts with the affected drive model

How to Mitigate CVE-2026-43487

Immediate Actions Required

• Identify all hosts containing the ST1000DM010-2EP102 drive through asset inventory queries
• Apply the kernel update containing the libata quirk addition on affected systems
• Until patching is complete, set the SATA link power management policy to max_performance to prevent the freeze condition

Patch Information

The fix is delivered through the Linux kernel stable tree. Review the upstream commits at git.kernel.org commit 87f0349b, git.kernel.org commit a4bfb194, git.kernel.org commit b3b1d3ae, and git.kernel.org commit f897b72c. Distribution maintainers backport these changes into their supported kernel branches. Apply the vendor-provided kernel package and reboot.

Workarounds

• Set the SATA link power policy to max_performance via /sys/class/scsi_host/hostX/link_power_management_policy on affected systems
• Disable aggressive power management in the system BIOS or UEFI firmware where supported
• Replace the affected drive with a model not subject to the LPM quirk if persistent freezes occur before patching

# Configuration example: disable LPM on all SATA hosts until patched
for host in /sys/class/scsi_host/host*/link_power_management_policy; do
    echo max_performance > "$host"
done