vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-90202

scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers

N/A
Published: September 17, 2026 at 04:07 PM UTC
Updated: October 19, 2026 at 09:19 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers _base_release_memory_pools() unconditionally frees every ioc->pcie_sg_lookup[] entry, including ones the setup loop never allocated after a partial failure, causing a "bad dma" warning on debug kernels or a NULL pointer dereference otherwise.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
90%
4.16dbec4c9040edc15442c3ebdb65408aa9d3b82c24
Vendor states this is fixed in 240b582b6372bebb1245d911add9954b7dd6c02d (fixed)
Vendor states this is fixed in 2dbdd025b228110ccbfbab95fe16e098313a14af (fixed)
Vendor states this is fixed in 3361709fb6f6568b157c6f24ed21a4a5d86d73db (fixed)
Vendor states this is fixed in a61181f9ee30a98d2350c1bff32954a7521f9a23 (fixed)
Vendor states this is fixed in afedf35df054bd713e9e13771aa0a056932c5c67 (fixed)
Vendor states this is fixed in b9f679dfe629004b593f018df33b330d799bcee4 (fixed)
Vendor states this is fixed in bc3398db3b64729b4a7907af317daad04795ad40 (fixed)
Vendor states this is fixed in e2cd23443d3616ea0876f27762b17e2ec67d896c (fixed)
Vendor states this is fixed in 4.16 (unaffected)
Vendor states this is fixed in 5.10.270 (unaffected)
Vendor states this is fixed in 5.15.221 (unaffected)
Vendor states this is fixed in 6.1.188 (unaffected)
Vendor states this is fixed in 6.12.110 (unaffected)
Vendor states this is fixed in 6.18.52 (unaffected)
Vendor states this is fixed in 6.6.157 (unaffected)
Vendor states this is fixed in 7.2.6 (unaffected)
Vendor states this is fixed in 7.3 (unaffected)
Vendor states this is fixed in 7.3-rc1 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (8)

Source: cverecord
https://git.kernel.org/stable/c/3361709fb6f6568b157c6f24ed21a4a5d86d73db
Source: cverecord
https://git.kernel.org/stable/c/240b582b6372bebb1245d911add9954b7dd6c02d
Source: cverecord
https://git.kernel.org/stable/c/a61181f9ee30a98d2350c1bff32954a7521f9a23
Source: cverecord
https://git.kernel.org/stable/c/afedf35df054bd713e9e13771aa0a056932c5c67
Source: cverecord
https://git.kernel.org/stable/c/bc3398db3b64729b4a7907af317daad04795ad40
Source: cverecord
https://git.kernel.org/stable/c/2dbdd025b228110ccbfbab95fe16e098313a14af
Source: cverecord
https://git.kernel.org/stable/c/e2cd23443d3616ea0876f27762b17e2ec67d896c
Source: cverecord
https://git.kernel.org/stable/c/b9f679dfe629004b593f018df33b330d799bcee4

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card