CVE-2026-98262
ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
No known exploitation. EPSS puts it in the 7th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c, < 0191c9ff23ef1678dbfb5ad253a2dee92feb5d71Upgrade to: 0191c9ff23ef1678dbfb5ad253a2dee92feb5d71Affected: ≥ c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c, < 8f510f68208a1f673d7c7234a687be4671490e9cUpgrade to: 8f510f68208a1f673d7c7234a687be4671490e9cAffected: ≥ c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c, < 4719424bb7cb9f20b73986bcb72dd528f0e5c6ebUpgrade to: 4719424bb7cb9f20b73986bcb72dd528f0e5c6ebAffected: ≥ c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c, < a5a8b4737f68bbac8aa0685af0c8921e6003c22bUpgrade to: a5a8b4737f68bbac8aa0685af0c8921e6003c22b + 4 more branchesStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY A user reported that commit 105c42566a55 ("ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585") made the JMicron JMB585 unusable on his board. The failure is seen as soon as the ahci driver is probed, and booting with iommu=off does not solve the problem. Looking at the AHCI specification, PxCLBU and PxFBU are both read only '0' for HBAs that do not support 64-bit addressing. For HBAs that do support 64-bit addressing, the registers are read write, with a reset value that is Implementation Specific. When using the AHCI_HFLAG_32BIT_ONLY flag, the HBA does support 64-bit addressing, and a 32-bit DMA mask is set by simply clearing HOST_CAP_64. Thus, in this case, we need to explicitly clear the registers to 0.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 7th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/0191c9ff23ef1678dbfb5ad253a2dee92feb5d71
- git.kernel.org/stable/c/8f510f68208a1f673d7c7234a687be4671490e9c
- git.kernel.org/stable/c/4719424bb7cb9f20b73986bcb72dd528f0e5c6eb
And 5 more references. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI