CVE-2026-97441 ata: ahci: fail probe if BAR too small for claimed ports
A local attacker with physical access or control over BIOS settings can trigger a kernel panic by configuring an AHCI controller with invalid port counts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97441?
CVE-2026-97441 is a denial of service vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ata: ahci: fail probe if BAR too small for claimed ports
When an AHCI controller is disabled in BIOS, its HOST_CAP register may contain a bogus value, e.g. 0xFFFFFFFF.
Since CAP.NP (Number of Ports) is a zeroes based 5-bit register field, a value of 0x1f means 32 ports. If CAP.NP claims more ports than can physically fit within the mapped BAR region, accessing port registers beyond the BAR boundary causes a kernel panic.
Add validation in ahci_init_one() to check that the BAR size is sufficient for the number of ports claimed in CAP.NP. The check calculates the required MMIO size as:
required_size = 0x100 (global registers) + max_ports * 0x80
If required_size exceeds the actual BAR size, the probe fails with -ENODEV, preventing the panic and providing a clear error message.
[cassel: commit log]
Which versions are affected by CVE-2026-97441?
How do I fix CVE-2026-97441?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-97441 being exploited?
There is no known exploitation of CVE-2026-97441 in the wild and no public exploit code.
Sources
Also known as AZL-103862, BELL-CVE-2026-97441, DEBIAN-CVE-2026-97441, GHSA-gq9q-jj7r-2h85, UBUNTU-CVE-2026-97441.