Junglewise Threat Intelligence

CVE-2026-43487: Linux Kernel system freeze in libata-core with Seagate BarraCuda drives

CVE-2026-43487 · Severity: info · Published 2026-05-13

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A stability issue in the Linux kernel's storage driver causes certain Seagate BarraCuda hard drives to trigger random system freezes. This occurs due to a compatibility problem with Link Power Management (LPM) on specific hardware models. An exploit or trigger of this issue results in a complete loss of system availability, requiring a hard reboot.

Technical details

A hardware compatibility issue exists in the Linux kernel's libata-core driver regarding Link Power Management (LPM) for specific Seagate BarraCuda drives (ST1000DM010-2EP102). When LPM is enabled, it can lead to a kernel hang or system freeze, resulting in a Denial of Service (DoS). The fix involves adding the affected drive model to the internal quirks list with the ATA_QUIRK_NOLPM flag to disable the problematic power management feature. This is a local availability issue rather than a remote code execution vulnerability. Patches have been merged into multiple stable kernel branches.

Affected products

  • Linux Linux Kernel All versions prior to the May 2026 patches

Timeline

  • 2026-03-04: other: Initial patch authored
  • 2026-05-13: disclosed: CVE published
  • 2026-05-13: patched: Patches available in stable kernel trees

References

Related threats