# CVE-2026-72030: ata: libata-core: Reject an invalid concurrent positioning ranges count

> A malicious storage device can trigger a buffer overflow in the Linux kernel's libata driver, potentially causing a crash or arbitrary code execution.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 15 Aug 2026
- **Updated:** 23 Aug 2026
- **Also known as:** BELL-CVE-2026-72030, DEBIAN-CVE-2026-72030, GHSA-wg7v-hx5v-fpj7, UBUNTU-CVE-2026-72030

## What is CVE-2026-72030?

CVE-2026-72030 is a memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

ata: libata-core: Reject an invalid concurrent positioning ranges count

ata_dev_config_cpr() takes the number of range descriptors from buf[0]
of the concurrent positioning ranges log (up to 255), which the device
reports independently of the log size in the GPL directory. The count is
then walked at a fixed 32-byte stride in two places with no bound: the
log read here, and the INQUIRY VPD page B9h emitter, which writes one
descriptor per range into the fixed 2048-byte ata_scsi_rbuf. A device
reporting a count larger than its own log overflows the read buffer (up
to 7704 bytes past a 512-byte slab), and a count above 62 overflows the
response buffer on the emit side.

Bound the count once, on probe, against both the log the device returned
and the number of descriptors the VPD B9h response buffer can hold
(ATA_DEV_MAX_CPR, derived from the rbuf size). Reject an out-of-range
count with a warning; this keeps the emitter in bounds with no separate
change there.

## Which versions are affected by CVE-2026-72030?


## How do I fix CVE-2026-72030?

Apply the vendor's patch.

## Is CVE-2026-72030 being exploited?

There is no known exploitation of CVE-2026-72030 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-72030 and fix it if it is affected.

What it is: CVE-2026-72030 is a memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-72030 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-72030/ (Markdown: https://insights.sbomify.com/CVE-2026-72030/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-72030
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-72030
- OSV: https://osv.dev/vulnerability/CVE-2026-72030

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-72030/
Summaries are generated and may contain mistakes; the official description above is the record.