{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ata: libata-scsi: bound the ATA passthru sense descriptor writes  When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and ata_scsi_set_passthru_sense_fields() trusts its additional length byte, sb[7], when adding the ATA Status Return descriptor.  A faulty or malicious device can use that to make the kernel read and write past the 96-byte buffer in three ways:  - scsi_sense_desc_find() is passed sb[7] + 8 as the buffer length, so   its clamp against sb[7] does nothing and the walk runs off the end. - A type-9 descriptor found near the end is filled in unchecked. - A new descriptor at sb[8 + len] needs len + 22 bytes, not len + 14,   so len 75..82 writes up to 8 bytes past the end.  Reproduced with KASAN under qemu, with the emulated ATAPI REQUEST SENSE reply patched:    BUG: KASAN: slab-out-of-bounds in scsi_sense_desc_find+0x1a5/0x210   BUG: KASAN: slab-out-of-bounds in ata_scsi_qc_complete+0x1a15/0x1a50  Both are gone with this patch, and a valid descriptor is still filled in.",
  "id": "DEBIAN-CVE-2026-98545",
  "modified": "2026-10-19T04:47:26.883607559Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98545"
    }
  ],
  "upstream": [
    "CVE-2026-98545"
  ]
}