{"id":"CVE-2026-98262","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY\n\nA user reported that commit 105c42566a55 (\"ata: ahci: force 32-bit DMA for\nJMicron JMB582/JMB585\") made …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY\n\nA user reported that commit 105c42566a55 (\"ata: ahci: force 32-bit DMA for\nJMicron JMB582/JMB585\") made …","severity":"high","vendor":"Linux","product":"Linux","affected":["Linux >= c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c < 0191c9ff23ef1678dbfb5ad253a2dee92feb5d71","Linux >= c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c < 8f510f68208a1f673d7c7234a687be4671490e9c","Linux >= c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c < 4719424bb7cb9f20b73986bcb72dd528f0e5c6eb","Linux >= c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c < a5a8b4737f68bbac8aa0685af0c8921e6003c22b","Linux >= c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c < b28a17d4a9bb0aa38b48681c3927b012ba40eabe","Linux >= c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c < b691a3e244278362e552439d6d3ee5a5d3703488","Linux >= c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c < 7912ad8fb5233bb8cfe21d50df639c7f4854ff9d","Linux >= c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c < 82e47533221d4746947b74d2e79a478c36c6433a","Linux 2.6.22"],"published":"2026-10-06","updated":"2026-10-06","sourceUpdated":"2026-10-06T09:18:15.347","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-98262","references":[{"url":"https://git.kernel.org/stable/c/0191c9ff23ef1678dbfb5ad253a2dee92feb5d71","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4719424bb7cb9f20b73986bcb72dd528f0e5c6eb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7912ad8fb5233bb8cfe21d50df639c7f4854ff9d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/82e47533221d4746947b74d2e79a478c36c6433a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f510f68208a1f673d7c7234a687be4671490e9c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a5a8b4737f68bbac8aa0685af0c8921e6003c22b","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b28a17d4a9bb0aa38b48681c3927b012ba40eabe","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b691a3e244278362e552439d6d3ee5a5d3703488","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98262.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98262"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2546533"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98262"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98262"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98262.mbox"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ingestedAt":"2026-10-06T08:50:17.427Z","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":["CWE-909"],"epss":0.00177,"epssPercentile":0.07176,"slug":"CVE-2026-98262","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY\n\nA user reported that commit 105c42566a55 (\"ata: ahci: force 32-bit DMA for\nJMicron JMB582/JMB585\") made the JMicron JMB585 unusable on his board.\n\nThe failure is seen as soon as the ahci driver is probed, and booting with\niommu=off does not solve the problem.\n\nLooking at the AHCI specification, PxCLBU and PxFBU are both read only '0'\nfor HBAs that do not support 64-bit addressing.\n\nFor HBAs that do support 64-bit addressing, the registers are read write,\nwith a reset value that is Implementation Specific.\n\nWhen using the AHCI_HFLAG_32BIT_ONLY flag, the HBA does support 64-bit\naddressing, and a 32-bit DMA mask is set by simply clearing HOST_CAP_64.\nThus, in this case, we need to explicitly clear the registers to 0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98262.json)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":218410,"id":"CVE-2026-98262","ts":1791533714836,"field":"cvss","old":null,"new":"7"},{"seq":218409,"id":"CVE-2026-98262","ts":1791533714836,"field":"severity","old":"none","new":"high"}]}