CVE-2026-46105

Technical summary

The mpt3sas driver initializes max_hw_sectors based on NVMe MDTS (Maximum Data Transfer Size) values reported by the HBA firmware without accounting for the driver's architectural constraints. The driver's fixed 4 KB PRP (Physical Region Page) list buffer accommodates 512 entries, enforcing a practical 2 MiB transfer limit. When the reported MDTS exceeds this limit, the driver permits I/O requests that exceed its buffer capacity, causing memory corruption and kernel panic when the oversized request is processed. The fix caps max_hw_sectors to the minimum of the firmware-reported MDTS and the 2 MiB driver limit, ensuring all requests remain within safe boundaries.

Business impact

This vulnerability can cause denial of service through kernel crashes on systems using mpt3sas-based NVMe HBAs. Affected systems may experience unexpected reboots, data loss if writes are interrupted, and service unavailability. The impact is limited to local users with valid credentials, but in multi-tenant or shared storage environments, even unprivileged users with login access could trigger the crash. Organizations relying on high-availability storage configurations may face unplanned downtime and disrupted workloads.

Affected systems

The Linux kernel is affected, specifically systems running the mpt3sas driver for Broadcom's storage HBAs that support NVMe. This includes Megaraid SAS 9000 and 9500 series controllers and related variants. Both server-class storage arrays and workstations with these HBAs are at risk. Verify your kernel version and confirm whether mpt3sas is in use via 'lsmod | grep mpt3sas' and check HBA model with 'lspci' for Broadcom/Avago/Seagate storage controllers.

Exploitability

Exploitation requires local system access and user-level privileges (non-root). An attacker must be able to issue I/O requests—for example, through direct file system operations, container orchestration, or virtualized storage access. The barrier to exploitation is moderate; no advanced techniques are needed beyond triggering large I/O transfers. However, the crash is not guaranteed to be exploitable for code execution; the primary impact is denial of service. The vulnerability is not known to be actively exploited in the wild.

Remediation

Apply a kernel patch that implements the MDTS-to-driver-limit capping logic in the mpt3sas driver. Patched versions restrict max_hw_sectors to the smaller of the firmware-reported value and the 2 MiB driver maximum. Verify the patch version against your Linux distribution's security advisory. Until patching is possible, limit I/O request sizes at the application or block device layer, or restrict user access to NVMe storage interfaces.

Patch guidance

Check your Linux distribution's security updates for mpt3sas driver fixes. Kernel patches typically become available in stable release series shortly after vulnerability disclosure. Fedora, RHEL, Ubuntu, Debian, and SUSE generally backport such fixes to supported kernel branches. Consult your vendor's security advisory for exact patched kernel versions. For systems unable to update immediately, use 'blockdev' or storage management tools to impose I/O size limits at the device level as a temporary mitigation.

Detection guidance

Monitor kernel logs (dmesg, /var/log/kern.log) for mpt3sas driver errors and kernel oops messages. Look for stack traces mentioning 'mpt3sas' or 'sas_scsi_host' combined with memory access violations. Enable audit logging for I/O operations if your system supports it. Systems experiencing unexpected crashes or reboots with mpt3sas in the driver stack should be investigated for this vulnerability. Use 'uname -r' to identify your kernel version and cross-reference against patched versions published by your distribution.

Why prioritize this

HIGH severity warrants prompt attention due to denial-of-service impact, broad applicability across Linux-based storage systems, and the simplicity of triggering the flaw from an unprivileged user context. While not critical like code execution flaws, the crash vector directly threatens availability. Prioritize patching for production storage servers, hypervisors, and containerized environments where storage I/O is intensive. Development and test systems are lower priority but should not be neglected.

Risk score, explained

CVSS 3.1 score of 7.8 (HIGH) reflects high impact (complete loss of confidentiality, integrity, and availability via crash) but limited attack vector (local-only) and privilege requirement (low-level user). The score does not account for exploit maturity or prevalence; the vulnerability is not yet in active exploitation. Organizations should weight the score against their own risk tolerance, the prevalence of mpt3sas HBAs in their environment, and the criticality of affected systems.

Frequently asked questions