HIGH
scsi/mpt3sas NVMe Buffer Overflow
CVE-2026-46105
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Limit NVMe request size to 2 MiB The HBA firmware reports NVMe MDTS values based on the underlying drive capability. However, because the driver allocates a fixed 4K buffer for the PRP list, accommodating at most 512 entries, the driver supports a maximum I/O transfer size of 2 MiB. Limit max_hw_sectors to the smaller of the reported MDTS and the 2 MiB driver limit to prevent issuing oversized I/O that may lead to a kernel oops.
02KernelScan AI Analysis
Risk summary
Systems with Broadcom MPT3SAS HBA controllers and NVMe drives are vulnerable to kernel crashes when large I/O operations exceed the driver's 2 MiB buffer limit. This affects storage servers and workstations using these controllers for NVMe storage access.
Vulnerability analysis
The root cause is a mismatch between the block layer's increased default maximum I/O size (4 MiB as of kernel 6.17) and the MPT3SAS driver's hardcoded 4K PRP list buffer that can only handle 512 entries, limiting transfers to 2 MiB. When the firmware reports NVMe MDTS values larger than 2 MiB and the block layer attempts I/O operations exceeding this limit, the driver's fixed buffer is overrun, leading to kernel oops. The fix caps max_hw_sectors to the minimum of the reported MDTS and the driver's 2 MiB limit, preventing oversized I/O requests from reaching the vulnerable buffer handling code.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.18 | 6.18.30 | 45dcc815fc55 |
| 7.0 | 7.0.7 | e5f9824817c6 |
| mainline | 7.1-rc3 | 04631f55afc5 |