CVE-2026-72030 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ata: libata-core: Reject an invalid concurrent positioning ranges count
ata_dev_config_cpr() takes the number of range descriptors from buf[0]
of the concurrent positioning ranges log (up to 255), which the device reports independently of the log size in the GPL directory. The count is then walked at a fixed 32-byte stride in two places with no bound: the log read here, and the INQUIRY VPD page B9h emitter, which writes one descriptor per range into the fixed 2048-byte ata_scsi_rbuf. A device reporting a count larger than its own log overflows the read buffer (up to 7704 bytes past a 512-byte slab), and a count above 62 overflows the response buffer on the emit side.
Bound the count once, on probe, against both the log the device returned and the number of descriptors the VPD B9h response buffer can hold (ATA_DEV_MAX_CPR, derived from the rbuf size). Reject an out-of-range count with a warning; this keeps the emitter in bounds with no separate change there.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical buffer overflow condition within the Linux kernel's libata-core subsystem that affects how concurrent positioning ranges are processed during ATA device configuration. This flaw exists in the ata_dev_config_cpr() function which handles parsing of concurrent positioning ranges logs from storage devices, creating a scenario where malformed device responses can lead to memory corruption and potential privilege escalation. The vulnerability stems from inadequate input validation where the function accepts an unbounded count value directly from device-reported data without proper bounds checking against both the actual log size and the response buffer capacity.
The technical implementation flaw occurs when the function reads buf[0] to determine the number of range descriptors, which can theoretically reach up to 255 entries as reported by the device. However, this count is then processed with a fixed 32-byte stride in two separate locations without any validation against actual buffer boundaries. The first overflow occurs during log reading where a device reporting an excessive count can cause memory corruption extending up to 7704 bytes beyond the expected 512-byte slab buffer, while the second overflow happens during VPD page B9h response generation when counts exceed 62 descriptors, overflowing the fixed 2048-byte ata_scsi_rbuf buffer. This dual overflow scenario presents multiple attack vectors that could be exploited by malicious devices or through crafted firmware responses.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially enable privilege escalation and system instability within Linux environments utilizing ATA storage subsystems. Attackers could craft storage devices that report excessive concurrent positioning range counts, leading to kernel memory corruption during device enumeration and configuration phases. The vulnerability affects systems where libata-core processes ATA device information, particularly impacting servers and embedded systems that rely heavily on storage device enumeration and SCSI command translation. This represents a significant concern for enterprise environments where storage device compatibility and system stability are paramount.
The mitigation strategy involves implementing bounds checking at the probe phase to validate the concurrent positioning ranges count against both the actual log size returned by the device and the maximum capacity of the VPD B9h response buffer defined as ATA_DEV_MAX_CPR. This approach prevents both overflow conditions by rejecting out-of-range counts with appropriate warning messages while maintaining existing functionality. The solution aligns with security best practices outlined in CWE-129 Input Validation and CWE-787 Out-of-bounds Write, addressing the root cause through proper input validation rather than attempting to fix symptoms through buffer boundary adjustments. This approach also corresponds to ATT&CK technique T1059 Command and Scripting Interpreter where malicious inputs could be used to exploit such vulnerabilities during system initialization phases. The implementation ensures that the emitter code does not require separate modifications since all bounds checking is performed at the initial validation stage, maintaining code integrity while preventing buffer overflows across both read and write operations.