CVE-2026-97441

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ata: ahci: fail probe if BAR too small for claimed ports

When an AHCI controller is disabled in BIOS, its HOST_CAP register may

contain a bogus value, e.g. 0xFFFFFFFF.

Since CAP.NP (Number of Ports) is a zeroes based 5-bit register field,

a value of 0x1f means 32 ports. If CAP.NP claims more ports than can

physically fit within the mapped BAR region, accessing port registers

beyond the BAR boundary causes a kernel panic.

Add validation in ahci_init_one() to check that the BAR size is

sufficient for the number of ports claimed in CAP.NP. The check

calculates the required MMIO size as:

required_size = 0x100 (global registers) + max_ports * 0x80

If required_size exceeds the actual BAR size, the probe fails with

-ENODEV, preventing the panic and providing a clear error message.

[cassel: commit log]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References