Improper initialization in Linux kernel - CVE-2026-98262
Published: October 7, 2026
Vulnerability identifier: #VU153757
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98262
CWE-ID: CWE-665
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper initialization of the PxCLBU and PxFBU registers in ahci_start_fis_rx() in drivers/ata/libahci.c when probing the ahci driver. A local user can trigger initialization of an affected AHCI controller to cause a denial of service.
The issue occurs on HBAs that support 64-bit addressing but operate with the AHCI_HFLAG_32BIT_ONLY flag. The reported failure leaves a JMicron JMB585 controller unusable.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98262
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/0191c9ff23ef1678dbfb5ad253a2dee92feb5d71
- https://git.kernel.org/stable/c/4719424bb7cb9f20b73986bcb72dd528f0e5c6eb
- https://git.kernel.org/stable/c/7912ad8fb5233bb8cfe21d50df639c7f4854ff9d
- https://git.kernel.org/stable/c/82e47533221d4746947b74d2e79a478c36c6433a
- https://git.kernel.org/stable/c/8f510f68208a1f673d7c7234a687be4671490e9c
- https://git.kernel.org/stable/c/a5a8b4737f68bbac8aa0685af0c8921e6003c22b
- https://git.kernel.org/stable/c/b28a17d4a9bb0aa38b48681c3927b012ba40eabe
- https://git.kernel.org/stable/c/b691a3e244278362e552439d6d3ee5a5d3703488