CVE-2026-89586 Overview
CVE-2026-89586 is a Linux kernel vulnerability in the libata-scsi subsystem that breaks DSM TRIM operations on ATA storage devices with logical sector sizes larger than 2048 bytes. The flaw resides in ata_scsi_write_same_xlat(), which translates SCSI WRITE SAME commands with the UNMAP bit set into ATA DATA SET MANAGEMENT TRIM commands. On 4Kn devices where the logical sector size is 4096 bytes, every TRIM request is rejected with a "Parameter list length error" and triggers a WARN_ON() splat. The vulnerability affects storage reliability and system availability on affected hardware configurations.
Critical Impact
TRIM and discard operations fail completely on ATA devices with logical sector sizes larger than 2048 bytes, causing kernel warnings and degrading storage subsystem availability.
Affected Products
- Linux kernel versions containing the affected libata-scsi implementation
- Systems using ATA storage devices with 4Kn (4096-byte) logical sectors
- Distributions shipping vulnerable kernel builds prior to the referenced stable commits
Discovery Timeline
- 2026-09-11 - CVE-2026-89586 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89586
Vulnerability Analysis
The defect lives in ata_format_dsm_trim_descr(), which builds the TRIM descriptor payload inside the 2048-byte ata_scsi_rbuf staging buffer. The function clamps its copy length to ATA_SCSI_RBUF_SIZE (2048 bytes). The caller then compares the returned size against sdp->sector_size and rejects the command when the two values differ. On a device with a 4096-byte logical sector, the returned length can never match the expected sector size, so the comparison fails on every request. The result is that the block layer receives a parameter length error for each TRIM, and the kernel emits repeated WARN_ON() traces.
Root Cause
The descriptor was incorrectly sized against the device's logical sector size. A DSM TRIM payload is defined as a list of 512-byte pages, each holding up to ATA_MAX_TRIM_RNUM (64) LBA Range Entries. This structure is independent of the underlying logical sector size. The Block Limits VPD page already advertises a single 512-byte page as the maximum WRITE SAME length, so the block layer never issues a request requiring more than one page. Coupling the descriptor length to sector_size was therefore both incorrect and unnecessary.
Attack Vector
The issue is triggered by any TRIM or discard operation dispatched to an affected ATA device, including filesystem fstrim, discard mount option activity, and administrative blkdiscard calls. Exploitation does not require authentication in the traditional sense; any workload that generates discard traffic to a 4Kn device on a vulnerable kernel will provoke repeated failures and kernel warnings, degrading availability of the storage subsystem. The upstream fix emits exactly one 512-byte page and transfers only that page (COUNT == 1), independent of the logical sector size.
No verified public exploit code exists. See the referenced Linux Kernel Commit 04e2befe for the authoritative patch.
Detection Methods for CVE-2026-89586
Indicators of Compromise
- Repeated kernel log entries containing "Parameter list length error" associated with WRITE SAME or SCSI opcode 0x93 on ATA devices.
- WARN_ON() stack traces originating from ata_scsi_write_same_xlat() or ata_format_dsm_trim_descr().
- fstrim and blkdiscard operations failing with EINVAL or EIO on devices reporting a 4096-byte logical sector size.
Detection Strategies
- Inventory Linux hosts and enumerate attached ATA devices reporting a logical sector size greater than 2048 bytes using lsblk -o NAME,LOG-SEC,PHY-SEC.
- Correlate kernel ring buffer output (dmesg) with scheduled fstrim.timer executions to identify systematic TRIM failures.
- Query the running kernel version against the fixed commits listed in the kernel.org stable references to determine exposure.
Monitoring Recommendations
- Forward /var/log/kern.log and journalctl -k output to a centralized log store and alert on libata warnings.
- Monitor storage health telemetry for rising rates of failed discard commands, which indicate the defect is active in production.
- Track kernel package versions across the fleet and flag hosts still running pre-patch builds on hardware with 4Kn ATA storage.
How to Mitigate CVE-2026-89586
Immediate Actions Required
- Update the Linux kernel to a stable release that includes the fix referenced in the upstream commits.
- Identify hosts using ATA storage with a logical sector size greater than 2048 bytes and prioritize them for patching.
- Suspend scheduled fstrim jobs on affected hosts until the patched kernel is deployed to prevent repeated kernel warnings.
Patch Information
The upstream fix modifies ata_format_dsm_trim_descr() to emit exactly one 512-byte DSM TRIM page and transfer only that page, independent of the device's logical sector size. Behavior on 512-byte-sector devices is unchanged, while 4Kn devices function correctly. Reference commits include Linux Kernel Commit 04e2befe, Linux Kernel Commit 07975b8d, Linux Kernel Commit 07baa310, Linux Kernel Commit 4a4268a0, Linux Kernel Commit 79cce911, Linux Kernel Commit 977554ed, Linux Kernel Commit b7b5ab2d, and Linux Kernel Commit c2e3dccd.
Workarounds
- Disable the discard mount option and stop the fstrim.timer unit on hosts with 4Kn ATA devices until patching is complete.
- Where feasible, migrate affected workloads to storage devices reporting a 512-byte logical sector size to avoid the failing code path.
- Rate-limit kernel log ingestion to prevent excessive WARN_ON() output from overwhelming log pipelines prior to patch deployment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
