CVE-2026-98545

What it actually does

Out-of-bounds read and write in libata-scsi sense buffer handling for failed ATA PASS-THROUGH commands to ATAPI devices, caused by trusting an unvalidated length byte (sb[7]) from a potentially malicious device response, leading to three distinct overflows in scsi_sense_desc_find and descriptor population.

Why it matters to the business

Kernel memory corruption on Linux systems can cause crashes, denial of service, or potential privilege escalation when interacting with faulty or attacker-controlled ATAPI hardware; low exploitability but affects broad kernel deployments five days after disclosure with stable low EPSS.

How an attack unfolds

An attacker supplies a malicious ATAPI device that returns a crafted REQUEST SENSE reply with manipulated sb[7] when an ATA PASS-THROUGH command fails; the kernel then performs unchecked buffer walks and descriptor writes that exceed the 96-byte sense buffer, as demonstrated via KASAN in emulated qemu environments.

How to fix it

Apply the upstream kernel patch that bounds ATA passthru sense descriptor writes; rebuild and deploy the fixed kernel across all affected distributions; verify the change prevents the three overflow paths while preserving valid descriptor handling.

How to confirm the fix worked

Confirm presence of the bounding logic in ata_scsi_set_passthru_sense_fields and scsi_sense_desc_find; re-test with KASAN-enabled qemu emulation using the original malicious sense reply pattern to ensure no slab-out-of-bounds reports occur.

Typical attack path

1. Connect or present a faulty or attacker-controlled ATAPI device to the Linux system
2. Issue an ATA PASS-THROUGH command that triggers a device failure response
3. Device returns REQUEST SENSE data with sb[7] set to induce out-of-bounds access
4. Kernel executes scsi_sense_desc_find and ata_scsi_set_passthru_sense_fields leading to slab corruption

How to detect it

Search kernel logs and dmesg for KASAN slab-out-of-bounds reports mentioning scsi_sense_desc_find or ata_scsi_qc_complete; examine SCSI sense buffer handling paths during ATA command failures for unexpected descriptor lengths near the 96-byte boundary.

• BUG: KASAN: slab-out-of-bounds in scsi_sense_desc_find+0x1a5/0x210
• BUG: KASAN: slab-out-of-bounds in ata_scsi_qc_complete+0x1a15/0x1a50
• ata_scsi_set_passthru_sense_fields

What your security team should do

• Prioritize kernel updates on systems with ATAPI/ATA devices within the next patch cycle given recent disclosure
• Monitor kernel logs for KASAN or slab corruption messages related to scsi_sense_desc_find or ata_scsi_qc_complete
• Restrict use of untrusted or external ATAPI hardware until patches are applied