Executive brief
The Linux kernel's ATA driver contains a buffer overflow vulnerability in how it handles concurrent positioning ranges (CPR) data reported by storage devices. A malicious or misconfigured storage device that reports an incorrect number of range descriptors could cause the kernel to read or write beyond the bounds of allocated buffers, potentially leading to kernel memory corruption, system crashes, or code execution.
Technical details
The vulnerability exists in the ata_dev_config_cpr() function in drivers/ata/libata-core.c. The function reads a count of CPR descriptors from device-reported log data and processes them at a fixed 32-byte stride without validating the count against either the actual log size or the fixed-size response buffer (ata_scsi_rbuf, 2048 bytes). A device reporting a count larger than the log size causes a read buffer overflow (up to 7704 bytes past a 512-byte allocation), and a count above 62 overflows the 2048-byte response buffer used for INQUIRY VPD page B9h emission. The patch adds validation checks to reject counts exceeding both the actual log size and ATA_DEV_MAX_CPR (derived from the response buffer size). No authentication or user interaction is required; a local attacker with ability to control or emulate a storage device could trigger the overflow.
Affected products
- Linux Linux Kernel All versions with concurrent positioning ranges support (linux 5.7+)
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-07-28: patched: Fix submitted by Bryam Vargas
- 2026-08-23: other: Patch merged to stable kernel by Greg Kroah-Hartman