Description
In the Linux kernel, the following vulnerability has been resolved:
ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS
UBSAN complains about array-index-out-of-bounds:
[ 1.980703] kernel: UBSAN: array-index-out-of-bounds in /build/linux-9H675w/linux-5.15.0/drivers/ata/libahci.c:968:41
[ 1.980709] kernel: index 15 is out of range for type 'ahci_em_priv [8]'
[ 1.980713] kernel: CPU: 0 PID: 209 Comm: scsi_eh_8 Not tainted 5.15.0-25-generic #25-Ubuntu
[ 1.980716] kernel: Hardware name: System manufacturer System Product Name/P5Q3, BIOS 1102 06/11/2010
[ 1.980718] kernel: Call Trace:
[ 1.980721] kernel: <TASK>
[ 1.980723] kernel: show_stack+0x52/0x58
[ 1.980729] kernel: dump_stack_lvl+0x4a/0x5f
[ 1.980734] kernel: dump_stack+0x10/0x12
[ 1.980736] kernel: ubsan_epilogue+0x9/0x45
[ 1.980739] kernel: __ubsan_handle_out_of_bounds.cold+0x44/0x49
[ 1.980742] kernel: ahci_qc_issue+0x166/0x170 [libahci]
[ 1.980748] kernel: ata_qc_issue+0x135/0x240
[ 1.980752] kernel: ata_exec_internal_sg+0x2c4/0x580
[ 1.980754] kernel: ? vprintk_default+0x1d/0x20
[ 1.980759] kernel: ata_exec_internal+0x67/0xa0
[ 1.980762] kernel: sata_pmp_read+0x8d/0xc0
[ 1.980765] kernel: sata_pmp_read_gscr+0x3c/0x90
[ 1.980768] kernel: sata_pmp_attach+0x8b/0x310
[ 1.980771] kernel: ata_eh_revalidate_and_attach+0x28c/0x4b0
[ 1.980775] kernel: ata_eh_recover+0x6b6/0xb30
[ 1.980778] kernel: ? ahci_do_hardreset+0x180/0x180 [libahci]
[ 1.980783] kernel: ? ahci_stop_engine+0xb0/0xb0 [libahci]
[ 1.980787] kernel: ? ahci_do_softreset+0x290/0x290 [libahci]
[ 1.980792] kernel: ? trace_event_raw_event_ata_eh_link_autopsy_qc+0xe0/0xe0
[ 1.980795] kernel: sata_pmp_eh_recover.isra.0+0x214/0x560
[ 1.980799] kernel: sata_pmp_error_handler+0x23/0x40
[ 1.980802] kernel: ahci_error_handler+0x43/0x80 [libahci]
[ 1.980806] kernel: ata_scsi_port_error_handler+0x2b1/0x600
[ 1.980810] kernel: ata_scsi_error+0x9c/0xd0
[ 1.980813] kernel: scsi_error_handler+0xa1/0x180
[ 1.980817] kernel: ? scsi_unjam_host+0x1c0/0x1c0
[ 1.980820] kernel: kthread+0x12a/0x150
[ 1.980823] kernel: ? set_kthread_struct+0x50/0x50
[ 1.980826] kernel: ret_from_fork+0x22/0x30
[ 1.980831] kernel: </TASK>
This happens because sata_pmp_init_links() initialize link->pmp up to
SATA_PMP_MAX_PORTS while em_priv is declared as 8 elements array.
I can't find the maximum Enclosure Management ports specified in AHCI
spec v1.3.1, but "12.2.1 LED message type" states that "Port Multiplier
Information" can utilize 4 bits, which implies it can support up to 16
ports. Hence, use SATA_PMP_MAX_PORTS as EM_MAX_SLOTS to resolve the
issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 2.6.27 | 4.9.332 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 6.0.6-1 | — |
| Debian 13 | linux | 6.0.6-1 | — |
| Debian 12 | linux | 6.0.6-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1014.16 | — |
| Ubuntu 24.04 LTS | linux-intel +9 | No fix yet | — |
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-60.66 | — |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1030.34 | — |
| Ubuntu 22.04 LTS | linux-azure | 5.15.0-1033.40 | — |
| Ubuntu 22.04 LTS | linux-azure-fde | 5.15.0-1033.40.1 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1029.36 | — |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1027.32 | — |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1015.19 | — |
| Ubuntu 22.04 LTS | linux-ibm | 5.15.0-1025.28 | — |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1025.30 | — |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1028.33 | — |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1017.17 | — |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1029.35 | — |
| Ubuntu 22.04 LTS | linux-raspi | 5.15.0-1024.26 | — |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 20.04 LTS | linux | 5.4.0-139.156 | — |
| Ubuntu 20.04 LTS | linux-aws | 5.4.0-1096.104 | — |
| Ubuntu 20.04 LTS | linux-aws-5.15 | 5.15.0-1030.34~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-azure | 5.4.0-1103.109 | — |
| Ubuntu 20.04 LTS | linux-azure-5.15 | 5.15.0-1033.40~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-bluefield | 5.4.0-1058.64 | — |
| Ubuntu 20.04 LTS | linux-gcp | 5.4.0-1100.109 | — |
| Ubuntu 20.04 LTS | linux-gcp-5.15 | 5.15.0-1029.36~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 20.04 LTS | linux-hwe-5.15 +1 | 5.15.0-60.66~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-ibm | 5.4.0-1044.49 | — |
| Ubuntu 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1025.30~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-iot | 5.4.0-1012.14 | — |
| Ubuntu 20.04 LTS | linux-kvm | 5.4.0-1086.92 | — |
| Ubuntu 20.04 LTS | linux-oracle | 5.4.0-1093.102 | — |
| Ubuntu 20.04 LTS | linux-oracle-5.15 | 5.15.0-1029.35~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-raspi | 5.4.0-1080.91 | — |
| Ubuntu 20.04 LTS | linux-riscv-5.15 | 5.15.0-1029.33~20.04.1 | — |
| Ubuntu 20.04 LTS | linux-xilinx-zynqmp | 5.4.0-1021.25 | — |
| Ubuntu 18.04 LTS | linux | 4.15.0-204.215 | — |
| Ubuntu 18.04 LTS | linux-aws | 4.15.0-1150.163 | — |
| Ubuntu 18.04 LTS | linux-aws-5.4 | 5.4.0-1096.104~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-azure-4.15 | 4.15.0-1161.176 | — |
| Ubuntu 18.04 LTS | linux-azure-5.4 | 5.4.0-1103.109~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp-4.15 | 4.15.0-1145.161 | — |
| Ubuntu 18.04 LTS | linux-gcp-5.4 | 5.4.0-1100.109~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-hwe-5.4 | 5.4.0-139.156~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-ibm-5.4 | 5.4.0-1044.49~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-kvm | 4.15.0-1135.140 | — |
| Ubuntu 18.04 LTS | linux-oracle | 4.15.0-1114.125 | — |
| Ubuntu 18.04 LTS | linux-oracle-5.4 | 5.4.0-1093.102~18.04.1 | — |
| Ubuntu 18.04 LTS | linux-raspi-5.4 | 5.4.0-1080.91~18.04.1 | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1096.104+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1103.109+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1072.81 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1100.109+fips1 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-aws-fips | 4.15.0-2089.95 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-azure-fips | 4.15.0-2070.76 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips | 4.15.0-1107.118 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-gcp-fips | 4.15.0-2054.59 | — |
| Ubuntu Pro FIPS-updates 16.04 LTS | linux-fips | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux +2 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | linux-aws-hwe | 4.15.0-1151.164~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-azure | 4.15.0-1162.177~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-gcp | 4.15.0-1146.162~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-hwe | 4.15.0-206.217~16.04.1 | — |
| Ubuntu Pro 16.04 LTS | linux-oracle | 4.15.0-1115.126~16.04.1 | — |
| Ubuntu Pro 14.04 LTS | linux +2 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | linux-azure | 4.15.0-1162.177~14.04.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 E4S | bpftool | 7.0.0-284.200.1.el9_2 | RHSA-2026:92993 |
| RHEL 9.2 E4S | kernel-rt +14 | 5.14.0-284.200.1.rt14.485.el9_2 | RHSA-2026:93047 |
| RHEL 9.2 E4S | perf +47 | 5.14.0-284.200.1.el9_2 | RHSA-2026:92993 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | kernel-livepatch-4.14.299-223.520 | 1.0-0.amzn2 | ALAS2-2022-1888 |
| Amazon Linux 2 | perf +8 | 4.14.299-223.520.amzn2 | ALAS2-2022-1888 |
Advisories 4
- RHSA-2026:93047 Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:92993 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2025-2053 Linux Kernel: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026
- ALAS2-2022-1888 Important: kernel security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 19, 2025
References
- https://git.kernel.org/stable/c/f70bd4339cb68bc7e206af4c922bc0d249244403
- https://git.kernel.org/stable/c/da2ea4a961d9f89ed248734e7032350c260dc3a3
- https://git.kernel.org/stable/c/67a00c299c5c143817c948fbc7de1a2fa1af38fb
- https://git.kernel.org/stable/c/383b7c50f5445ff8dbbf03080905648d6980c39d
- https://git.kernel.org/stable/c/303d0f761431d848dd8d7ff9fd9b8c101879cabe
- https://git.kernel.org/stable/c/8fbe13de1cc7cef2564be3cbf60400b33eee023b
- https://git.kernel.org/stable/c/d6314d5f68764550c84d732ce901ddd3ac6b415f
- https://git.kernel.org/stable/c/1e41e693f458eef2d5728207dbd327cd3b16580a