Linux kernel libahci leaves AHCI DMA base registers uncleared
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Partial Red Hat: 6 without a fix
No CVSS vector from any source. Fix status from CNA and Red Hat.
Summary
The Linux kernel libahci driver does not clear the PxCLBU and PxFBU registers when the AHCI_HFLAG_32BIT_ONLY flag is set, so controllers that support 64-bit addressing keep implementation-specific values in them. A user reported that a JMicron JMB585 became unusable as soon as the ahci driver was probed, and booting with iommu=off did not solve the problem. The Linux kernel is affected from 2.6.22 until the fixed releases listed in the solution.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
In the Linux kernel, the following vulnerability has been resolved: ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY A user reported that commit 105c42566a55 ("ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585") made the JMicron JMB585 unusable on his board. The failure is seen as soon as the ahci driver is probed, and booting with iommu=off does not solve the problem. Looking at the AHCI specification, PxCLBU and PxFBU are both read only '0' for HBAs that do not support 64-bit addressing. For HBAs that do support 64-bit addressing, the registers are read write, with a reset value that is Implementation Specific. When using the AHCI_HFLAG_32BIT_ONLY flag, the HBA does support 64-bit addressing, and a 32-bit DMA mask is set by simply clearing HOST_CAP_64. Thus, in this case, we need to explicitly clear the registers to 0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 2.6.22 and later | 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, 7.3 | Patch available | CNA |
- Linux VendorLinux Affected 2.6.22 and later Fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, 7.3 Patch available CNA
Remediation
Update the Linux kernel to 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 or 7.3 on the matching branch. Red Hat lists Red Hat Enterprise Linux 7, 8, 9 and 10 and Red Hat OpenShift Container Platform 4 and 5 as affected with the plan none_available.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA Linux (Linux) Fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, 7.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Enterprise Linux 6
Timeline
- 2026-10-06 Threatist record created from CVE-2026-98262
- 2026-10-06 Alias added: GHSA-599j-5783-gx62
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-09 CVSS score added · Red Hat
- 2026-10-19 Fix available: Linux/[email protected] · CNA
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-01 Affected versions changed · Red Hat
References
Other 8
- https://git.kernel.org/stable/c/0191c9ff23ef1678dbfb5ad253a2dee92feb5d71
- https://git.kernel.org/stable/c/8f510f68208a1f673d7c7234a687be4671490e9c
- https://git.kernel.org/stable/c/4719424bb7cb9f20b73986bcb72dd528f0e5c6eb
- https://git.kernel.org/stable/c/a5a8b4737f68bbac8aa0685af0c8921e6003c22b
- https://git.kernel.org/stable/c/b28a17d4a9bb0aa38b48681c3927b012ba40eabe
- https://git.kernel.org/stable/c/b691a3e244278362e552439d6d3ee5a5d3703488
- https://git.kernel.org/stable/c/7912ad8fb5233bb8cfe21d50df639c7f4854ff9d
- https://git.kernel.org/stable/c/82e47533221d4746947b74d2e79a478c36c6433a
More Linux vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
Sources
- CVE-2026-98262 · CVE Program
- CVE-2026-98262 · NVD
- FIRST EPSS
- GHSA-599j-5783-gx62 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-98262 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences