CVE-2026-46105
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel mpt3sas driver, a vulnerability was found due to missing limit of NVMe request size to 2 MiB. The HBA reports MDTS based on drive capability, but the driver allocates a fixed 4K buffer for the PRP list, allowing at most 512 entries, i.e., 2 MiB transfer. Lack of limit may lead to oversized I/O and kernel oops.
Risk Assessment
Risk involves possible system hang or crash (kernel oops) during I/O operations on NVMe drives attached via SAS3 controller. This may lead to data loss or service unavailability.
Recommendation
Update the Linux kernel to a version containing the fix that limits max_hw_sectors to the smaller of MDTS and 2 MiB. In the meantime, manually limit NVMe request size via kernel parameters or driver configuration.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Limit NVMe request size to 2 MiB The HBA firmware reports NVMe MDTS values based on the underlying drive capability. However, because the driver allocates a fixed 4K buffer for the PRP list, accommodating at most 512 entries, the driver supports a maximum I/O transfer size of 2 MiB. Limit max_hw_sectors to the smaller of the reported MDTS and the 2 MiB driver limit to prevent issuing oversized I/O that may lead to a kernel oops.