---
id: CVE-2026-98545
title: 'ata: libata-scsi: bound the ATA passthru sense descriptor writes'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ata: libata-scsi: bound the ATA passthru sense descriptor writes

  When an ATA PASS-THROUGH command to an ATAPI device fails, the sense
  buffer holds the device's REQUEST…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ce477199c53e3db5a096981c565e232498ddeae4 <
    c698f6deabf680f8f4a1727ef2dc80fe78815fbf
  - >-
    Linux >= 97981926224afe17ba3e22e0c2b7dd8b516ee574 <
    d9a7147b93624660626cd7c3b1143715699e1f5c
  - >-
    Linux >= 97981926224afe17ba3e22e0c2b7dd8b516ee574 <
    1603abb0c50420e97cf4a1feddbd5e183c5fdf86
  - >-
    Linux >= 97981926224afe17ba3e22e0c2b7dd8b516ee574 <
    80fbb0bc4d11683c88f2f9d3997ea02fcada5408
  - >-
    Linux >= 97981926224afe17ba3e22e0c2b7dd8b516ee574 <
    80320b278fea07ffcda3f57b67b61658e0a4e1ca
  - Linux 67d9d0b6ae4aaf2c4cef103a96a145c7fdfb15f8
  - Linux >= 6.6.44 < 6.6.158
  - Linux >= 6.10.3 < 6.11
  - Linux 6.11
published: '2026-10-18'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T09:21:28.453Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98545'
references:
  - url: 'https://git.kernel.org/stable/c/c698f6deabf680f8f4a1727ef2dc80fe78815fbf'
  - url: 'https://git.kernel.org/stable/c/d9a7147b93624660626cd7c3b1143715699e1f5c'
  - url: 'https://git.kernel.org/stable/c/1603abb0c50420e97cf4a1feddbd5e183c5fdf86'
  - url: 'https://git.kernel.org/stable/c/80fbb0bc4d11683c88f2f9d3997ea02fcada5408'
  - url: 'https://git.kernel.org/stable/c/80320b278fea07ffcda3f57b67b61658e0a4e1ca'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.267Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-scsi: bound the ATA passthru sense descriptor writes

When an ATA PASS-THROUGH command to an ATAPI device fails, the sense
buffer holds the device's REQUEST SENSE reply, and
ata_scsi_set_passthru_sense_fields() trusts its additional length
byte, sb[7], when adding the ATA Status Return descriptor.  A faulty
or malicious device can use that to make the kernel read and write
past the 96-byte buffer in three ways:

- scsi_sense_desc_find() is passed sb[7] + 8 as the buffer length, so
  its clamp against sb[7] does nothing and the walk runs off the end.
- A type-9 descriptor found near the end is filled in unchecked.
- A new descriptor at sb[8 + len] needs len + 22 bytes, not len + 14,
  so len 75..82 writes up to 8 bytes past the end.

Reproduced with KASAN under qemu, with the emulated ATAPI REQUEST SENSE
reply patched:

  BUG: KASAN: slab-out-of-bounds in scsi_sense_desc_find+0x1a5/0x210
  BUG: KASAN: slab-out-of-bounds in ata_scsi_qc_complete+0x1a15/0x1a50

Both are gone with this patch, and a valid descriptor is still filled
in.

## Affected

- `Linux >= ce477199c53e3db5a096981c565e232498ddeae4 < c698f6deabf680f8f4a1727ef2dc80fe78815fbf`
- `Linux >= 97981926224afe17ba3e22e0c2b7dd8b516ee574 < d9a7147b93624660626cd7c3b1143715699e1f5c`
- `Linux >= 97981926224afe17ba3e22e0c2b7dd8b516ee574 < 1603abb0c50420e97cf4a1feddbd5e183c5fdf86`
- `Linux >= 97981926224afe17ba3e22e0c2b7dd8b516ee574 < 80fbb0bc4d11683c88f2f9d3997ea02fcada5408`
- `Linux >= 97981926224afe17ba3e22e0c2b7dd8b516ee574 < 80320b278fea07ffcda3f57b67b61658e0a4e1ca`
- `Linux 67d9d0b6ae4aaf2c4cef103a96a145c7fdfb15f8`
- `Linux >= 6.6.44 < 6.6.158`
- `Linux >= 6.10.3 < 6.11`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.