PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46105 Linux CVE debrief

A vulnerability in the Linux kernel's mpt3sas SCSI driver could allow oversized NVMe I/O requests to trigger a kernel oops. The driver allocates a fixed 4K buffer for PRP (Physical Region Page) lists, supporting at most 512 entries and thus a maximum 2 MiB transfer size. However, the HBA firmware reports NVMe MDTS (Maximum Data Transfer Size) values based on underlying drive capabilities, which may exceed this driver limit. The fix limits max_hw_sectors to the smaller of the reported MDTS and the 2 MiB driver-imposed maximum.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-30
Advisory published
2026-05-28
Advisory updated
2026-05-30

Who should care

System administrators running Linux systems with mpt3sas HBAs connected to NVMe storage; kernel maintainers and distribution security teams packaging kernel updates

Technical summary

The mpt3sas driver in the Linux kernel did not properly limit NVMe request sizes to match its internal 4K PRP list buffer capacity (512 entries, 2 MiB max). The HBA firmware reports MDTS values based on drive capabilities, which could exceed this limit. The vulnerability is resolved by capping max_hw_sectors to the minimum of the reported MDTS and the 2 MiB driver limit, preventing oversized I/O requests that could cause kernel oops conditions.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the mpt3sas NVMe request size limit fix
  • Verify mpt3sas driver version includes the max_hw_sectors limitation to 2 MiB
  • Monitor systems using mpt3sas HBAs with NVMe drives for stability issues prior to patching
  • Review kernel logs for oops traces related to mpt3sas NVMe I/O operations

Evidence notes

The vulnerability description indicates a kernel oops can occur when oversized I/O is issued due to a mismatch between firmware-reported MDTS and the driver's fixed 4K PRP list buffer. The fix was committed to the Linux kernel stable tree.

Official resources

2026-05-28