CVE-2026-89586 in Linux
Summary
by MITRE • 09/12/2026
In the Linux kernel, the following vulnerability has been resolved:
ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
ata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is built by ata_format_dsm_trim_descr() into the 2048-byte ata_scsi_rbuf staging buffer, and the number of bytes copied is compared against the logical sector size by the caller:
size = ata_format_dsm_trim_descr(scmd, trmax, block, n_block); if (size != len) /* len == sdp->sector_size */ goto invalid_param_len;
ata_format_dsm_trim_descr() clamps the copy length to ATA_SCSI_RBUF_SIZE (2048). On a device whose logical sector size exceeds that (e.g. a 4Kn device, where sector_size == 4096) the function can never return more than 2048, while the caller expects it to return sector_size. The comparison therefore always fails, so every TRIM is rejected with "Parameter list length error" and WARN_ON() splats on each attempt. TRIM / discard is thus completely broken on such devices.
The descriptor was incorrectly sized from the logical sector size. A DSM TRIM payload is a list of 512-byte pages, each holding up to ATA_MAX_TRIM_RNUM (64) LBA Range Entries, and is independent of the logical sector size. The Block Limits VPD page already advertises a single such page as the maximum WRITE SAME length (65535 * ATA_MAX_TRIM_RNUM logical blocks), so the block layer never sends a request that needs more than one page.
Emit exactly one 512-byte page, independent of the logical sector size, and transfer only that page (COUNT == 1). For a 512-byte-sector device this is unchanged; devices with larger logical sectors now work instead of failing every TRIM.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/12/2026
The Linux kernel contained a critical defect within the libata-scsi subsystem that prevented the Data Set Management Trim command from functioning correctly on storage devices utilizing logical sector sizes greater than 2048 bytes, such as modern 4Kn drives with 4096-byte sectors. This vulnerability stemmed from an incorrect assumption in the ata_scsi_write_same_xlat function regarding the size of the TRIM descriptor buffer and its relationship to the device's logical sector size. When a SCSI WRITE SAME command containing the UNMAP bit was issued, the kernel attempted to translate it into an ATA DATA SET MANAGEMENT TRIM command. The translation process relied on the ata_format_dsm_trim_descr function to populate a staging buffer named ata_scsi_rbuf, which had a fixed maximum capacity of 2048 bytes.
The core technical flaw lay in the validation logic that followed the descriptor construction. After calling ata_format_dsm_trim_descr, the code compared the returned size against len, which was derived from sdp->sector_size. Because the formatting function clamped its output to the ATA_SCSI_RBUF_SIZE limit of 2048 bytes, it could never return a value equal to or greater than 4096 for devices with larger sector sizes. Consequently, this comparison always failed, triggering an invalid parameter length error and causing the kernel to emit WARN_ON splats while rejecting every TRIM operation. This resulted in complete functional failure of discard capabilities on affected hardware, preventing efficient space reclamation and potentially impacting storage performance over time as unused blocks could not be properly marked for deletion by the underlying flash media or other non-rotational storage technologies.
From a vulnerability classification perspective, this issue aligns with CWE-20 Improper Input Validation, specifically involving incorrect boundary checks that fail to account for variable input sizes in a way that breaks expected functionality rather than causing memory corruption. The operational impact is primarily functional denial of service regarding the TRIM feature, which falls under ATT&CK technique T1485 Data Destruction via volume shadow copy deletion or similar storage-level data invalidation mechanisms, although here it manifests as an inability to perform legitimate maintenance operations rather than malicious destruction. The root cause was a misunderstanding of the ATA specification requirements for DSM TRIM payloads, which are structured as lists of 512-byte pages independent of the host's logical sector size.
The resolution involved correcting the descriptor sizing logic to emit exactly one 512-byte page regardless of the device's logical sector configuration and ensuring that only this single page is transferred with a count of one. This adjustment decouples the TRIM payload structure from the variable sector sizes, allowing devices with 4096-byte sectors to successfully process discard commands just as effectively as those with traditional 512-byte or 2048-byte sectors. By aligning the implementation with the Block Limits VPD page specifications which advertise a maximum WRITE SAME length that fits within standard TRIM descriptor limits, the fix restores full functionality of storage space reclamation features across all supported sector sizes without introducing new security risks or performance regressions for existing configurations.