CVE-2024-40901scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory
Updated under an hour ago ()
Does this affect you?
It affects Linux and 4 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory There is a potential out-of-bounds access when using test_bit() on a single word. The test_bit() and set_bit() functions operate on long values, and when testing or setting a single word, they can exceed the word boundary. KASAN detects this issue and produces a dump: BUG: KASAN: slab-out-of-bounds in _scsih_add_device.constprop.0 (./arch/x86/include/asm/bitops.h:60 ./include/asm-generic/bitops/instrumented-atomic.h:29 drivers/scsi/mpt3sas/mpt3sas_scsih.c:7331) mpt3sas Write of size 8 at addr ffff8881d26e3c60 by task kworker/u1536:2/2965 For full log, please look at [1]. Make the allocation at least the size of sizeof(unsigned long) so that set_bit() and test_bit() have sufficient room for read/write operations without overwriting unallocated memory. [1] Link: https://lore.kernel.org/all/ZkNcALr3W3KGYYJG@gmail.com/
- CVSS
- 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from c696f7b83edeac804e898952058089143f49ca0a before e9bce7c751f6d6c7be88c0bc081a66aaf61a23ee; from c696f7b83edeac804e898952058089143f49ca0a before 19649e49a6df07cd2e03e0a11396fd3a99485ec2; from c696f7b83edeac804e898952058089143f49ca0a before 0081d2b3ae0a17a86b8cc0fa3c8bdc54e233ba16; from c696f7b83edeac804e898952058089143f49ca0a before 521f333e644c4246ca04a4fc4772edc53dd2a801; from c696f7b83edeac804e898952058089143f49ca0a before 46bab2bcd771e725ff5ca3a68ba68cfeac45676c; from c696f7b83edeac804e898952058089143f49ca0a before 9079338c5a0d1f1fee34fb1c9e99b754efe414c5; from c696f7b83edeac804e898952058089143f49ca0a before 18abb5db0aa9b2d48f7037a88b41af2eef821674; from c696f7b83edeac804e898952058089143f49ca0a before 4254dfeda82f20844299dca6c38cbffcfd499f41 | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.0 before V3.1.5 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 4.10 before 4.19.317; from 4.20 before 5.4.279; from 5.5 before 5.10.221; from 5.11 before 5.15.162; from 5.16 before 6.1.95; from 6.2 before 6.6.35; from 6.7 before 6.9.6; 6.10; and 2 more ranges | NVD |
References
- https://git.kernel.org/stable/c/e9bce7c751f6d6c7be88c0bc081a66aaf61a23eemailing-list, patch
- https://git.kernel.org/stable/c/19649e49a6df07cd2e03e0a11396fd3a99485ec2mailing-list, patch
- https://git.kernel.org/stable/c/0081d2b3ae0a17a86b8cc0fa3c8bdc54e233ba16mailing-list, patch
- https://git.kernel.org/stable/c/521f333e644c4246ca04a4fc4772edc53dd2a801mailing-list, patch
- https://git.kernel.org/stable/c/46bab2bcd771e725ff5ca3a68ba68cfeac45676cmailing-list, patch
- https://git.kernel.org/stable/c/9079338c5a0d1f1fee34fb1c9e99b754efe414c5mailing-list, patch
- https://git.kernel.org/stable/c/18abb5db0aa9b2d48f7037a88b41af2eef821674mailing-list, patch
- https://git.kernel.org/stable/c/4254dfeda82f20844299dca6c38cbffcfd499f41mailing-list, patch
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
- https://cert-portal.siemens.com/productcert/html/ssa-355557.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.