All vulnerabilities
CVE-2026-98088

Linux: scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in06a994ad7bbd13714cd45df582389f751531e60cAlso 7bcce856c79c1799351e170aec83e018ccf3d044, 0a5f7cdb0cb911584720591069065f09c59ec4fc and 2 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 06a994ad7bbd13714cd45df582389f751531e60cLinuxCVE List
  • 7bcce856c79c1799351e170aec83e018ccf3d044LinuxCVE List
  • 0a5f7cdb0cb911584720591069065f09c59ec4fcLinuxCVE List
  • 7b23144c3ff6e46d7d4a464b02f8944265684e39LinuxCVE List
  • 45504e621b7e884abe59f201e093a3eac7fca7feLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()

dev_to_node() can return NUMA_NO_NODE (-1) on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose device-to-node affinity. Passing -1 directly into cpumask_of_node() indexes node_to_cpumask_map[-1], an out-of-bounds array read caught by UBSAN:

UBSAN: array-index-out-of-bounds in arch/x86/include/asm/topology.h:72:28 index -1 is out of range for type 'cpumask *[1024]'

Fall back to cpu_online_mask when no NUMA node is available, rather than assuming dev_to_node() always returns a valid node index.

Text from CVE List

Affected versions 16

  • Linuxaffected: 728bbc6cbff70051813730fb7977f5d99d867e12 before f531758ef21ba9a7716148cc290e8d9a110f20d9CVE List
  • Linuxaffected: 728bbc6cbff70051813730fb7977f5d99d867e12 before 06a994ad7bbd13714cd45df582389f751531e60cCVE List
  • Linuxaffected: 728bbc6cbff70051813730fb7977f5d99d867e12 before 7bcce856c79c1799351e170aec83e018ccf3d044CVE List
  • Linuxaffected: 728bbc6cbff70051813730fb7977f5d99d867e12 before 0a5f7cdb0cb911584720591069065f09c59ec4fcCVE List
  • Linuxaffected: 728bbc6cbff70051813730fb7977f5d99d867e12 before 7b23144c3ff6e46d7d4a464b02f8944265684e39CVE List
  • Linuxaffected: 728bbc6cbff70051813730fb7977f5d99d867e12 before 45504e621b7e884abe59f201e093a3eac7fca7feCVE List
  • Linuxaffected: 728bbc6cbff70051813730fb7977f5d99d867e12 before e0d26fe176a8db6ccad4ab38c5bab29391c1946bCVE List
  • Linuxaffected: 5.3CVE List
  • Linuxunaffected: all versions before 5.3CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7