Executive brief
The Linux kernel's megaraid_sas driver has a buffer overflow vulnerability when handling NVMe commands. When building a list of memory pointers for large data transfers, the driver fails to check if the list fits in its allocated buffer, causing it to write past the buffer boundary. This can lead to memory corruption, data loss, or system crashes on servers with NVMe storage.
Technical details
The megasas_make_prp_nvme() function builds a Physical Region Page (PRP) list in cmd->sg_frame, a DMA buffer of max_chain_frame_sz bytes. The function loops to construct the PRP list for NVMe page translations but does not validate that the list remains within buffer bounds. With increased block layer defaults (4 MiB after commit 9b8b84879d4a), large transfers require ~1025 entries causing the list to overflow beyond the 512-entry 4 KiB frame. The overflow either triggers a page fault or silently corrupts adjacent in-flight command PRP lists. The fix caps max_hw_sectors based on the actual chain frame capacity, derived from max_chain_frame_sz.
Affected products
- Linux Linux kernel 4.x and later (after commit 9b8b84879d4a)
Timeline
- 2026-09-16: disclosed