Is there a patch available for CVE-2026-98262?

Yes, a patch is available for CVE-2026-98262. Update the affected software to the latest version immediately.

Linux CVE-2026-98262

EUVD-2026-93190

2026-10-06 Linux

GHSA-599j-5783-gx62

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY

A user reported that commit 105c42566a55 ("ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585") made the JMicron JMB585 unusable on his board.

The failure is seen as soon as the ahci driver is probed, and booting with iommu=off does not solve the problem.

Looking at the AHCI specification, PxCLBU and PxFBU are both read only '0' for HBAs that do not support 64-bit addressing.

For HBAs that do support 64-bit addressing, the registers are read write, with a reset value that is Implementation Specific.

When using the AHCI_HFLAG_32BIT_ONLY flag, the HBA does support 64-bit addressing, and a 32-bit DMA mask is set by simply clearing HOST_CAP_64. Thus, in this case, we need to explicitly clear the registers to 0.

Affected VersionsENISA

Linux c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c <b28a17d4a9bb0aa38b48681c3927b012ba40eabe

Linux patch: 7.2.8

Linux c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c <b691a3e244278362e552439d6d3ee5a5d3703488

Linux patch: 6.12.112

Linux c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c <82e47533221d4746947b74d2e79a478c36c6433a

Linux patch: 6.1.189

Linux patch: 6.18.54

Linux patch: 5.15.222

Linux patch: 5.10.271

Linux c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c <4719424bb7cb9f20b73986bcb72dd528f0e5c6eb

Linux 2.6.22

Linux c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c <7912ad8fb5233bb8cfe21d50df639c7f4854ff9d

Linux c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c <8f510f68208a1f673d7c7234a687be4671490e9c

Linux c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c <a5a8b4737f68bbac8aa0685af0c8921e6003c22b

Linux c7a42156d99bcea7f8173ba7a6034bbaa2ecb77c <0191c9ff23ef1678dbfb5ad253a2dee92feb5d71

Linux patch: 7.3-rc4

Linux patch: 0

Linux patch: 6.6.158

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 06, 2026 - 10:02 EUVD

CVE Published

Oct 06, 2026 - 08:45 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.