Executive brief
The Linux kernel's ATA SCSI layer incorrectly handles TRIM (disk space reclamation) commands on storage devices with sector sizes larger than 2048 bytes, such as 4K-native drives. This causes all TRIM operations to be rejected with parameter length errors, effectively disabling the ability to efficiently reclaim unused disk space on these devices.
Technical details
A logic error in ata_format_dsm_trim_descr() causes DSM TRIM descriptor validation to fail on devices with logical sector sizes exceeding 2048 bytes. The function clamps the copy length to ATA_SCSI_RBUF_SIZE (2048), but the caller expects it to return the full logical sector size; on 4Kn devices this mismatch causes the size check to always fail. The root cause is that TRIM descriptor size was incorrectly derived from logical sector size rather than being a fixed 512-byte page format independent of sector size. TRIM operations are network-reachable through SCSI commands but require a capable storage device and active block layer requests. An attacker cannot directly exploit this, but the failure to process TRIM commands degrades storage efficiency and could be leveraged in denial-of-service scenarios involving rapid disk wear. Patches are available in recent kernel versions.
Affected products
- Linux Linux kernel multiple versions prior to fix
Timeline
- 2026-09-11: disclosed