CVE-2026-98545: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-98545 Overview

CVE-2026-98545 is an out-of-bounds read and write vulnerability in the Linux kernel's libata-scsi subsystem. The flaw resides in ata_scsi_set_passthru_sense_fields(), which processes sense data returned by ATAPI devices after a failed ATA PASS-THROUGH command. The function trusts the device-supplied additional length byte sb[7] without properly bounding it against the 96-byte sense buffer. A faulty or malicious ATAPI device can supply crafted sense data to force the kernel to read and write beyond the buffer. The issue was reproduced with Kernel Address Sanitizer (KASAN) under QEMU using a patched ATAPI REQUEST SENSE reply.

Critical Impact
A malicious or malfunctioning ATAPI device can trigger kernel out-of-bounds memory access in libata-scsi, potentially leading to kernel memory corruption or denial of service.

Affected Products

Linux kernel versions containing the vulnerable ata_scsi_set_passthru_sense_fields() logic in libata-scsi
Systems exposing ATAPI device paths through the SCSI layer
Virtualized guests with emulated ATAPI devices

Discovery Timeline

2026-10-18 - CVE-2026-98545 published to the National Vulnerability Database (NVD)
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98545

Vulnerability Analysis

The vulnerability stems from unchecked trust in device-supplied length fields when the kernel parses sense data from ATAPI devices. When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer stores the device's REQUEST SENSE reply. The function ata_scsi_set_passthru_sense_fields() reads sb[7], the additional length byte, and uses it to walk sense descriptors and append the ATA Status Return descriptor.

Three distinct boundary errors are present. First, scsi_sense_desc_find() receives sb[7] + 8 as the buffer length, which defeats the internal clamp against sb[7] and allows the descriptor walk to run past the end of the 96-byte buffer. Second, a type-9 descriptor located near the end of the buffer is populated without a boundary check. Third, a new descriptor appended at offset sb[8 + len] requires len + 22 bytes, not len + 14, causing writes up to 8 bytes past the buffer for len values between 75 and 82.

Root Cause

The root cause is improper input validation of attacker-controlled length fields in sense data parsing, resulting in out-of-bounds reads and writes against a fixed 96-byte kernel buffer. The arithmetic used to size descriptors understates the required space, and intermediate clamps are rendered ineffective.

Attack Vector

Exploitation requires an attacker-influenced ATAPI device response. This can occur with a malicious USB-attached ATAPI device, a compromised firmware on an optical drive, or an emulated ATAPI device in a virtualized environment. The attacker crafts a REQUEST SENSE reply with a manipulated sb[7] value and descriptor layout to force the kernel into out-of-bounds access.

No verified public exploit code is available. Reproduction was demonstrated by Linux kernel maintainers with KASAN under QEMU using a patched emulated ATAPI REQUEST SENSE reply, which produced the following reports:

BUG: KASAN: slab-out-of-bounds in scsi_sense_desc_find+0x1a5/0x210
BUG: KASAN: slab-out-of-bounds in ata_scsi_qc_complete+0x1a15/0x1a50

Detection Methods for CVE-2026-98545

Indicators of Compromise

KASAN slab-out-of-bounds reports referencing scsi_sense_desc_find or ata_scsi_qc_complete in kernel logs
Kernel oops, panic, or unexpected SCSI subsystem crashes correlated with ATAPI device I/O errors
Unusual REQUEST SENSE replies from ATAPI devices with abnormally large sb[7] additional length values

Detection Strategies

Enable KASAN on test or canary kernels to surface out-of-bounds access in the libata-scsi path
Monitor dmesg and journalctl -k for faults originating in ata_scsi_set_passthru_sense_fields or scsi_sense_desc_find
Audit installed kernel versions against upstream stable branches that include the fix commits referenced in NVD

Monitoring Recommendations

Collect kernel ring buffer logs centrally and alert on KASAN output and SCSI/ATA subsystem traces
Track hotplug events for USB-attached ATAPI devices in environments where optical media is uncommon
Baseline ATAPI command failure rates and investigate anomalous spikes in REQUEST SENSE activity

How to Mitigate CVE-2026-98545

Immediate Actions Required

Apply the upstream Linux kernel patches that bound the ATA passthru sense descriptor writes
Rebuild and redeploy kernels on affected systems, prioritizing hosts that expose ATAPI pathways
In virtualized environments, remove emulated ATAPI/CD-ROM devices from guest configurations where not required

Patch Information

The fix has been merged across multiple Linux stable branches. Review and apply the following upstream commits:

The patch bounds the sense buffer walk against the actual 96-byte buffer size, adds boundary checks for type-9 descriptors, and corrects the descriptor size calculation to len + 22.

Workarounds

Restrict physical access to systems with ATAPI/optical drives to prevent attachment of untrusted devices
Disable or unload ATAPI support where not operationally required
Remove emulated CD-ROM/ATAPI devices from virtual machine definitions where feasible

bash

# Example: remove the libata CD-ROM module where not needed
sudo modprobe -r sr_mod
# Verify no ATAPI devices remain exposed
ls /dev/sr* 2>/dev/null || echo "No ATAPI devices present"