CVE-2026-98088scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() dev_to_node() can return NUMA_NO_NODE (-1) on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose device-to-node affinity. Passing -1 directly into cpumask_of_node() indexes node_to_cpumask_map[-1], an out-of-bounds array read caught by UBSAN: UBSAN: array-index-out-of-bounds in arch/x86/include/asm/topology.h:72:28 index -1 is out of range for type 'cpumask *[1024]' Fall back to cpu_online_mask when no NUMA node is available, rather than assuming dev_to_node() always returns a valid node index.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Undergoing Analysis
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 728bbc6cbff70051813730fb7977f5d99d867e12 before f531758ef21ba9a7716148cc290e8d9a110f20d9; 728bbc6cbff70051813730fb7977f5d99d867e12 builds before 06a994ad7bbd13714cd45df582389f751531e60c; 728bbc6cbff70051813730fb7977f5d99d867e12 builds before 7bcce856c79c1799351e170aec83e018ccf3d044; 728bbc6cbff70051813730fb7977f5d99d867e12 builds before 0a5f7cdb0cb911584720591069065f09c59ec4fc; 728bbc6cbff70051813730fb7977f5d99d867e12 builds before 7b23144c3ff6e46d7d4a464b02f8944265684e39; from 728bbc6cbff70051813730fb7977f5d99d867e12 before 45504e621b7e884abe59f201e093a3eac7fca7fe; from 728bbc6cbff70051813730fb7977f5d99d867e12 before e0d26fe176a8db6ccad4ab38c5bab29391c1946b | CNA record |
References
- https://git.kernel.org/stable/c/f531758ef21ba9a7716148cc290e8d9a110f20d9
- https://git.kernel.org/stable/c/06a994ad7bbd13714cd45df582389f751531e60c
- https://git.kernel.org/stable/c/7bcce856c79c1799351e170aec83e018ccf3d044
- https://git.kernel.org/stable/c/0a5f7cdb0cb911584720591069065f09c59ec4fc
- https://git.kernel.org/stable/c/7b23144c3ff6e46d7d4a464b02f8944265684e39
- https://git.kernel.org/stable/c/45504e621b7e884abe59f201e093a3eac7fca7fe
- https://git.kernel.org/stable/c/e0d26fe176a8db6ccad4ab38c5bab29391c1946b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.