Executive brief
A vulnerability in the Linux kernel's Broadcom mpi3mr SCSI driver can cause a system crash during hardware initialization or cleanup. This occurs when the system attempts to clear memory for communication queues that were never successfully created or have already been removed. An attacker with local access could potentially exploit this to cause a denial-of-service (system crash), impacting the availability of the server and its storage operations.
Technical details
A NULL pointer dereference exists in the mpi3mr SCSI driver (drivers/scsi/mpi3mr/mpi3mr_fw.c) within the mpi3mr_memset_buffers function. The vulnerability is triggered during resource cleanup if the creation of request or reply queues fails; the driver attempts to perform a memset on queue structures (op_reply_qinfo and req_qinfo) that are NULL. A local attacker with sufficient privileges to trigger driver re-initialization or cleanup could cause a kernel panic. The fix introduces explicit NULL checks for these queue pointers before they are accessed during the reset process. Patching is available across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 5.17 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1, 7.0-rc2
Timeline
- 2026-02-12: other: Patch authored by Broadcom
- 2026-05-08: disclosed: CVE published by kernel.org
- 2026-05-08: advisory
- 2026-03-19: patched: Patch committed to stable tree
References
- https://git.kernel.org/stable/c/220d7ca70611a73d50ef8e9edac630ed1ececb7c
- https://git.kernel.org/stable/c/78d3f201f8b609928eade53cf03a52df5415aaf7
- https://git.kernel.org/stable/c/7da755e0d02e9ca035065127e108d1fed8950dc8
- https://git.kernel.org/stable/c/7df0296ad4e9253d12c6dbe7f120044dddc95600
- https://git.kernel.org/stable/c/e978a36f332ede78eb4de037b517db16265d420d
- https://git.kernel.org/stable/c/fa96392ebebc8fade2b878acb14cce0f71016503