CVE-2026-89586
nicheLinux kernel libata: DSM TRIM/discard fails on drives with >2048-byte sectors (4Kn)
A flaw in the Linux kernel's libata-scsi layer causes the SCSI WRITE SAME (UNMAP) to ATA DATA SET MANAGEMENT TRIM translation to be rejected on any device whose logical sector size exceeds 2048 bytes, such as 4Kn (4096-byte sector) drives. The TRIM descriptor was incorrectly sized from the logical sector size while being built in a fixed 2048-byte staging buffer, so on 4Kn devices the length check always fails, every TRIM is refused with a 'Parameter list length error', and a WARN_ON() stack trace is emitted on each attempt. An attacker does not gain code execution; the practical impact is complete loss of TRIM/discard functionality on affected drives, repeated kernel log splats, degraded SSD performance over time, and the possibility that 'deleted' data remains physically resident on the device because it is never trimmed. Affected systems are those running a kernel with the buggy code and ATA-attached storage using logical sectors larger than 2048 bytes. There is no known exploitation in the wild and no public proof of concept.
What to do: Apply a kernel release or stable backport containing the libata-scsi fix, which emits exactly one 512-byte TRIM page independent of logical sector size. On 4Kn hosts, check dmesg for repeated 'Parameter list length error' messages and ata_scsi WARN_ON() splats and verify TRIM works again with fstrim -v after updating. As an interim workaround, disable periodic trim (e.g., systemd fstrim.timer or the discard mount option) to stop log spam, keeping in mind that data deleted in the meantime may persist untrimmed on the device.
| Linux kernel (ata/libata-scsi, ata_scsi_write_same_xlat/ata_format_dsm_trim_descr) | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes ata_scsi_write_same_xlat() translates a SCSI WRITE SAME command with the UNMAP bit set into an ATA DATA SET MANAGEMENT TRIM command. The TRIM descriptor is built by ata_format_dsm_trim_descr() into the 2048-byte ata_scsi_rbuf staging buffer, and the number of bytes copied is compared against the logical sector size by the caller: size = ata_format_dsm_trim_descr(scmd, trmax, block, n_block); if (size != len) /* len == sdp->sector_size */ goto invalid_param_len; ata_format_dsm_trim_descr() clamps the copy length to ATA_SCSI_RBUF_SIZE (2048). On a device whose logical sector size exceeds that (e.g. a 4Kn device, where sector_size == 4096) the function can never return more than 2048, while the caller expects it to return sector_size. The comparison therefore always fails, so every TRIM is rejected with "Parameter list length error" and WARN_ON() splats on each attempt. TRIM / discard is thus completely broken on such devices. The descriptor was incorrectly sized from the logical sector size. A DSM TRIM payload is a list of 512-byte pages, each holding up to ATA_MAX_TRIM_RNUM (64) LBA Range Entries, and is independent of the logical sector size. The Block Limits VPD page already advertises a single such page as the maximum WRITE SAME length (65535 * ATA_MAX_TRIM_RNUM logical blocks), so the block layer never sends a request that needs more than one page. Emit exactly one 512-byte page, independent of the logical sector size, and transfer only that page (COUNT == 1). For a 512-byte-sector device this is unchanged; devices with larger logical sectors now work instead of failing every TRIM.
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
In the news0 stories
No ingested article mentions this CVE yet.