CVE-2026-89586

8.2

Linux · Kernel

A flaw in the Linux kernel libata-scsi subsystem causes TRIM commands to fail on devices with logical sector sizes exceeding 2048 bytes, resulting in potential system instability.

Executive summary

A vulnerability in the Linux kernel libata-scsi subsystem leads to denial of service on specific storage devices by incorrectly handling TRIM operations for large sector sizes.

Vulnerability

The issue exists in the ata_scsi_write_same_xlat function, which incorrectly calculates buffer sizes for DSM TRIM commands on devices with logical sector sizes larger than 2048 bytes. This leads to rejected commands and kernel warnings, effectively breaking TRIM/discard functionality for these devices.

Business impact

The failure of TRIM/discard operations on high-capacity storage devices can lead to significant degradation of write performance and, in certain configurations, system instability or service denial. With a CVSS score of 8.2, this vulnerability is classified as High severity, as it impacts the availability of critical storage subsystems which could disrupt business-critical applications.

Remediation

Immediate Action: Update the Linux kernel to version 6.12.109, 6.18.50, 7.2.4, or later versions where the patch has been integrated.

Proactive Monitoring: Monitor system logs for repeated "Parameter list length error" messages or kernel warnings related to libata-scsi and TRIM operations.

Compensating Controls: If patching is not immediately feasible, consider disabling TRIM operations for affected storage devices via mount options, though this may impact long-term drive performance and lifespan.

Exploitation status

Public Exploit Available: Unknown

Analyst recommendation

Given the potential for storage performance degradation and system instability, administrators should prioritize updating kernel versions on systems utilizing 4Kn or other high-sector-size storage drives. Applying the provided kernel patches is the only reliable method to ensure proper hardware communication and maintain system availability.

More Linux CVEs all →

History

CVE Brief tracked this CVE 1 day before it had a CVSS score.

  1. Disclosed CVE record published
  2. Collected by CVE Brief No CVSS score yet; tracked as early warning
  3. CVSS score assigned 8.2 (3.1)
  4. Analyst report written
  5. Published in the daily brief high section

Sources