{"id":"CVE-2026-89586","title":"ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes\n\nata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the\nUNMAP bit set into an A…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cvssSource":"cna","cwe":["CWE-130"],"vendor":"Linux","product":"Linux","affected":["Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < 07975b8daa3b0ab3cbc02cc48ea7bc48fadcec53","Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < b7b5ab2df325ffbbad7ca2debaa071e024d68cb5","Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < 07baa310ea3224a7044b1ca84796bb37a235af1f","Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < 977554ed91b54075fbc0bac536316b4841ef6258","Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < 04e2befe25792f2e90097f284d7e86fc6bcfe928","Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < c2e3dccd6870659851eaa4c12ab16418b8e3040a","Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < 4a4268a0b0a595bd9534cf9c7fda93775a7d8a0d","Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < 79cce911e623c0baa0fde307ce3a434e084b881a","Linux 4.9"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T19:24:31.774727Z"},"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:49:18.983Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89586","references":[{"url":"https://git.kernel.org/stable/c/07975b8daa3b0ab3cbc02cc48ea7bc48fadcec53"},{"url":"https://git.kernel.org/stable/c/b7b5ab2df325ffbbad7ca2debaa071e024d68cb5"},{"url":"https://git.kernel.org/stable/c/07baa310ea3224a7044b1ca84796bb37a235af1f"},{"url":"https://git.kernel.org/stable/c/977554ed91b54075fbc0bac536316b4841ef6258"},{"url":"https://git.kernel.org/stable/c/04e2befe25792f2e90097f284d7e86fc6bcfe928"},{"url":"https://git.kernel.org/stable/c/c2e3dccd6870659851eaa4c12ab16418b8e3040a"},{"url":"https://git.kernel.org/stable/c/4a4268a0b0a595bd9534cf9c7fda93775a7d8a0d"},{"url":"https://git.kernel.org/stable/c/79cce911e623c0baa0fde307ce3a434e084b881a"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89586.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89586"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532420"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89586"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89586"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89586.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00615,"epssPercentile":0.49256,"scores":{"cna":8.2,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.451Z","slug":"CVE-2026-89586","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes\n\nata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the\nUNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command.  The TRIM\ndescriptor is built by ata_format_dsm_trim_descr() into the 2048-byte\nata_scsi_rbuf staging buffer, and the number of bytes copied is compared\nagainst the logical sector size by the caller:\n\n\tsize = ata_format_dsm_trim_descr(scmd, trmax, block, n_block);\n\tif (size != len)\t\t/* len == sdp->sector_size */\n\t\tgoto invalid_param_len;\n\nata_format_dsm_trim_descr() clamps the copy length to ATA_SCSI_RBUF_SIZE\n(2048).  On a device whose logical sector size exceeds that (e.g. a 4Kn\ndevice, where sector_size == 4096) the function can never return more than\n2048, while the caller expects it to return sector_size.  The comparison\ntherefore always fails, so every TRIM is rejected with \"Parameter list\nlength error\" and WARN_ON() splats on each attempt.  TRIM / discard is\nthus completely broken on such devices.\n\nThe descriptor was incorrectly sized from the logical sector size.  A DSM\nTRIM payload is a list of 512-byte pages, each holding up to\nATA_MAX_TRIM_RNUM (64) LBA Range Entries, and is independent of the logical\nsector size.  The Block Limits VPD page already advertises a single such\npage as the maximum WRITE SAME length (65535 * ATA_MAX_TRIM_RNUM logical\nblocks), so the block layer never sends a request that needs more than one\npage.\n\nEmit exactly one 512-byte page, independent of the logical sector size,\nand transfer only that page (COUNT == 1).  For a 512-byte-sector device\nthis is unchanged; devices with larger logical sectors now work instead of\nfailing every TRIM.\n\n## Affected\n\n- `Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < 07975b8daa3b0ab3cbc02cc48ea7bc48fadcec53`\n- `Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < b7b5ab2df325ffbbad7ca2debaa071e024d68cb5`\n- `Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < 07baa310ea3224a7044b1ca84796bb37a235af1f`\n- `Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < 977554ed91b54075fbc0bac536316b4841ef6258`\n- `Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < 04e2befe25792f2e90097f284d7e86fc6bcfe928`\n- `Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < c2e3dccd6870659851eaa4c12ab16418b8e3040a`\n- `Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < 4a4268a0b0a595bd9534cf9c7fda93775a7d8a0d`\n- `Linux >= ef2d7392c4ece5c3cd12a6c7ca9366cd8f189aff < 79cce911e623c0baa0fde307ce3a434e084b881a`\n- `Linux 4.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89586.json)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":224697,"id":"CVE-2026-89586","ts":1792401476940,"field":"cvss","old":"5.5","new":"8.2"},{"seq":224696,"id":"CVE-2026-89586","ts":1792401476940,"field":"severity","old":"medium","new":"high"},{"seq":224258,"id":"CVE-2026-89586","ts":1792325048775,"field":"cvss","old":"8.2","new":"5.5"},{"seq":224257,"id":"CVE-2026-89586","ts":1792325048775,"field":"severity","old":"high","new":"medium"},{"seq":223279,"id":"CVE-2026-89586","ts":1792180039745,"field":"cvss","old":"5.5","new":"8.2"},{"seq":223278,"id":"CVE-2026-89586","ts":1792180039745,"field":"severity","old":"medium","new":"high"},{"seq":203915,"id":"CVE-2026-89586","ts":1789490221070,"field":"cvss","old":"8.2","new":"5.5"},{"seq":203914,"id":"CVE-2026-89586","ts":1789490221070,"field":"severity","old":"high","new":"medium"},{"seq":197888,"id":"CVE-2026-89586","ts":1789384320821,"field":"cvss","old":"4.4","new":"8.2"},{"seq":197887,"id":"CVE-2026-89586","ts":1789384320821,"field":"severity","old":"medium","new":"high"},{"seq":183439,"id":"CVE-2026-89586","ts":1789356675373,"field":"cvss","old":"8.2","new":"4.4"},{"seq":183438,"id":"CVE-2026-89586","ts":1789356675373,"field":"severity","old":"high","new":"medium"},{"seq":153404,"id":"CVE-2026-89586","ts":1789285350377,"field":"cvss","old":null,"new":"8.2"},{"seq":153403,"id":"CVE-2026-89586","ts":1789285350377,"field":"severity","old":"none","new":"high"},{"seq":147223,"id":"CVE-2026-89586","ts":1789270202420,"field":"cvss","old":null,"new":"4.4"},{"seq":147222,"id":"CVE-2026-89586","ts":1789270202420,"field":"severity","old":"none","new":"medium"},{"seq":108976,"id":"CVE-2026-89586","ts":1789183729805,"field":"cvss","old":null,"new":"4.4"},{"seq":108975,"id":"CVE-2026-89586","ts":1789183729805,"field":"severity","old":"none","new":"medium"}]}