01 Record

CVE-2026-90202

scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers

UnratedPUBLISHEDCNA: Linux

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.21% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 11.9% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Received. NVD last modified this record on 2026-10-19.
Red Hat severity: Low. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-09-17 16:07Z1 MO AGO

Last updated

2026-10-19 08:59Z10 DAYS AGO

Reserved

2026-09-11

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-476NULL Pointer DereferenceBase

Data version

5.2

Document digest

5711dad490a38c2f59f024259663f12098dbc804c5d364fdbf84cf67027fc3d0

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxdbec4c9040edc15442c3ebdb65408aa9d3b82c24 to < 3361709fb6f6568b157c6f24ed21a4a5d86d73db, dbec4c9040edc15442c3ebdb65408aa9d3b82c24 to < 240b582b6372bebb1245d911add9954b7dd6c02d, dbec4c9040edc15442c3ebdb65408aa9d3b82c24 to < a61181f9ee30a98d2350c1bff32954a7521f9a23, dbec4c9040edc15442c3ebdb65408aa9d3b82c24 to < afedf35df054bd713e9e13771aa0a056932c5c67, dbec4c9040edc15442c3ebdb65408aa9d3b82c24 to < bc3398db3b64729b4a7907af317daad04795ad40, dbec4c9040edc15442c3ebdb65408aa9d3b82c24 to < 2dbdd025b228110ccbfbab95fe16e098313a14af, dbec4c9040edc15442c3ebdb65408aa9d3b82c24 to < e2cd23443d3616ea0876f27762b17e2ec67d896c, dbec4c9040edc15442c3ebdb65408aa9d3b82c24 to < b9f679dfe629004b593f018df33b330d799bcee4, 4.16—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/3361709fb6f6568b157c6f24ed21a4a5d86d73db
git.kernel.orghttps://git.kernel.org/stable/c/240b582b6372bebb1245d911add9954b7dd6c02d
git.kernel.orghttps://git.kernel.org/stable/c/a61181f9ee30a98d2350c1bff32954a7521f9a23
git.kernel.orghttps://git.kernel.org/stable/c/afedf35df054bd713e9e13771aa0a056932c5c67
git.kernel.orghttps://git.kernel.org/stable/c/bc3398db3b64729b4a7907af317daad04795ad40
git.kernel.orghttps://git.kernel.org/stable/c/2dbdd025b228110ccbfbab95fe16e098313a14af
git.kernel.orghttps://git.kernel.org/stable/c/e2cd23443d3616ea0876f27762b17e2ec67d896c
git.kernel.orghttps://git.kernel.org/stable/c/b9f679dfe629004b593f018df33b330d799bcee4

07 Fixed in

Debian 12

linux
Fixed in 6.1.190-1
linux-6.12
Fixed in 6.12.111-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.111-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.2.6-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.