Executive brief
The Linux kernel's mpt3sas SCSI driver has a memory management flaw in the PCIe SGL (Scatter-Gather List) buffer cleanup routine. When device initialization fails partway through, the cleanup code attempts to free memory buffers that were never allocated, causing kernel warnings on debug systems or crashes on production systems. This can lead to system instability or denial of service during device error scenarios.
Technical details
The vulnerability is a use-after-free / double-free class bug in _base_release_memory_pools(). When _base_setup_iopoll_iocs() or similar initialization routines fail after partial allocation, ioc->pcie_sg_lookup[] entries remain uninitialized. However, _base_release_memory_pools() unconditionally iterates through all entries and attempts dma_pool_free() on NULL pointers, generating "bad dma" warnings on debug kernels or NULL pointer dereferences otherwise. The fix adds a NULL check before attempting to free each entry. No authentication or special privileges are required; the bug triggers during device attachment/initialization failure paths. A patch was merged upstream (commit b9f679dfe629004b593f018df33b330d799bcee4).
Affected products
- Linux Linux kernel Multiple versions (see kernel git log for full range)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Fix merged upstream (commit b9f679dfe629004b593f018df33b330d799bcee4)