CVE-2026-72030

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ata dev config cpr() function within the libata-core module. The function retrieves the number of range descriptors from buf[0] of the concurrent positioning ranges log. Because this count is processed with a fixed 32-byte stride without proper bounds checking, a device reporting a count larger than its own log can cause a read buffer overflow of up to 7704 bytes beyond a 512-byte slab. Additionally, a count exceeding 62 can overflow the response buffer in the INQUIRY VPD page B9h emitter, which writes descriptors into the fixed 2048-byte ata scsi rbuf.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.