PatchSiren cyber security CVE debrief

CVE-2026-46105 Linux CVE debrief

A vulnerability in the Linux kernel's mpt3sas SCSI driver could allow oversized NVMe I/O requests to trigger a kernel oops. The driver allocates a fixed 4K buffer for PRP (Physical Region Page) lists, supporting at most 512 entries and thus a maximum 2 MiB transfer size. However, the HBA firmware reports NVMe MDTS (Maximum Data Transfer Size) values based on underlying drive capabilities, which may exceed this driver limit. The fix limits max_hw_sectors to the smaller of the reported MDTS and the 2 MiB driver-imposed maximum.

Vendor: Linux
Product: Unknown
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-28
Original CVE updated: 2026-06-25
Advisory published: 2026-05-28
Advisory updated: 2026-06-25

Who should care

System administrators running Linux systems with mpt3sas HBAs connected to NVMe storage; kernel maintainers and distribution security teams packaging kernel updates

Technical summary

The mpt3sas driver in the Linux kernel did not properly limit NVMe request sizes to match its internal 4K PRP list buffer capacity (512 entries, 2 MiB max). The HBA firmware reports MDTS values based on drive capabilities, which could exceed this limit. The vulnerability is resolved by capping max_hw_sectors to the minimum of the reported MDTS and the 2 MiB driver limit, preventing oversized I/O requests that could cause kernel oops conditions.

Defensive priority

high

Recommended defensive actions

Apply kernel updates containing the mpt3sas NVMe request size limit fix
Verify mpt3sas driver version includes the max_hw_sectors limitation to 2 MiB
Monitor systems using mpt3sas HBAs with NVMe drives for stability issues prior to patching
Review kernel logs for oops traces related to mpt3sas NVMe I/O operations

Evidence notes

The vulnerability description indicates a kernel oops can occur when oversized I/O is issued due to a mismatch between firmware-reported MDTS and the driver's fixed 4K PRP list buffer. The fix was committed to the Linux kernel stable tree.

Sources and references

Verified primary and authoritative sources

CVE-2026-46105 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-46105

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-46105 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46105

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/04631f55afc543d5431a2bdee7f6cc0f2c0debe7

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/45dcc815fc5539e88154315f36cbcb11d3a52fc2

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Source reference
Unverified legacy reference

URL: https://git.kernel.org/stable/c/e5f9824817c6358b9f9738bdb92dec9e4e794d3c

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.