CVE-2026-98262 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
A user reported that commit 105c42566a55 ("ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585") made the JMicron JMB585 unusable on his board.
The failure is seen as soon as the ahci driver is probed, and booting with iommu=off does not solve the problem.
Looking at the AHCI specification, PxCLBU and PxFBU are both read only '0' for HBAs that do not support 64-bit addressing.
For HBAs that do support 64-bit addressing, the registers are read write, with a reset value that is Implementation Specific.
When using the AHCI_HFLAG_32BIT_ONLY flag, the HBA does support 64-bit addressing, and a 32-bit DMA mask is set by simply clearing HOST_CAP_64. Thus, in this case, we need to explicitly clear the registers to 0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel's Advanced Host Controller Interface (AHCI) subsystem contains a critical logic flaw regarding the handling of physical address high and low base unit registers for specific hardware configurations. This vulnerability manifests when the AHCI driver is probed on systems utilizing JMicron JMB582 or JMB585 storage controllers that are constrained to 32-bit Direct Memory Access (DMA) operations despite possessing underlying capabilities for 64-bit addressing. The root cause lies in a regression introduced by commit 105c42566a55, which attempted to force 32-bit DMA mode for these specific chipsets. While the intention was to restrict address width to prevent potential overflow issues, the implementation failed to properly initialize or clear the PxCLBU and PxFBU registers, leading to hardware malfunction that renders the storage controller unusable immediately upon driver initialization.
From a technical perspective, the AHCI specification defines PxCLBU (Physical Command List Base Unit) and PxFBU (Physical FIS Base Unit) as critical control registers used by the host bus adapter to locate command lists and receive data from devices. For Host Bus Adapters that do not support 64-bit addressing, these registers are read-only with a fixed value of zero. However, for HBAs capable of 64-bit addressing, these registers are read-write, and their reset values are implementation-specific rather than guaranteed to be zero. The vulnerability arises because the kernel code sets the AHCI_HFLAG_32BIT_ONLY flag by clearing the HOST_CAP_64 bit in the capability register, effectively telling the driver to operate in 32-bit mode. However, this action does not automatically reset the PxCLBU and PxFBU registers to zero. Since these registers retain their implementation-specific power-on or reset values, they may contain non-zero garbage data that points to invalid memory addresses when interpreted as physical pointers under a 32-bit constraint.
The operational impact of this flaw is severe for affected systems. When the ahci driver attempts to probe the device and initialize the storage controller, it relies on these registers to establish communication with attached SATA devices. Because PxCLBU and PxFBU contain undefined or incorrect values, the hardware fails to locate valid command lists or receive Frame-Based Data correctly. This results in a complete failure of the AHCI subsystem for that port, effectively making the connected storage device inaccessible during boot. Notably, this issue persists even when system-level mitigations such as disabling the IOMMU via kernel parameters are applied, indicating that the fault is intrinsic to the driver's interaction with the hardware registers rather than an external memory management unit conflict.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-754: Improper Check for Unusual or Exceptional Conditions from the Common Weakness Enumeration standard. The code fails to validate that clearing a capability flag necessitates explicit initialization of dependent hardware registers, assuming instead that state changes are handled implicitly by the driver framework. In terms of MITRE ATT&CK mapping, this represents an initial foothold vector if exploited in conjunction with other vulnerabilities, but primarily it falls under TA0002 Execution and TA0003 Persistence due to its ability to disrupt system availability and potentially be leveraged for denial-of-service attacks against critical infrastructure. The lack of explicit register clearing violates the principle of least privilege by allowing undefined hardware states to persist into operational phases where deterministic behavior is required.
To mitigate this vulnerability, kernel maintainers have implemented a fix that explicitly clears PxCLBU and PxFBU registers to zero when the AHCI_HFLAG_32BIT_ONLY flag is active for supported HBAs like the JMicron JMB585. This ensures that even though the hardware supports 64-bit addressing natively, the driver enforces strict adherence to 32-bit address boundaries by resetting all relevant base unit registers to a known safe state. System administrators should apply kernel updates containing this patch immediately. Until patched, workarounds are limited as disabling IOMMU does not resolve the issue; therefore, maintaining up-to-date kernel versions is essential for ensuring stability and availability of storage subsystems relying on these specific JMicron controllers.