CVE-2026-46105: scsi: mpt3sas: Limit NVMe request size to 2 MiB
In the Linux kernel, the following vulnerability has been resolved:
scsi: mpt3sas: Limit NVMe request size to 2 MiB
The HBA firmware reports NVMe MDTS values based on the underlying drive capability. However, because the driver allocates a fixed 4K buffer for the PRP list, accommodating at most 512 entries, the driver supports a maximum I/O transfer size of 2 MiB.
Limit maxhwsectors to the smaller of the reported MDTS and the 2 MiB driver limit to prevent issuing oversized I/O that may lead to a kernel oops.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel mpt3sas driver with NVMe devices behind a supported HBA may be exposed when the firmware-reported NVMe MDTS permits I/O larger than the driver's 2 MiB PRP-list capacity.
What is required to trigger the failure?
An attacker needs local access and low privileges, and must cause oversized I/O requests to be issued through the affected driver. No user interaction is required.
What is the impact of an oversized request?
Oversized I/O can exceed the driver's fixed 4K PRP-list buffer capacity and may cause a kernel oops, affecting confidentiality, integrity, and availability.
What can be done if the fix cannot be applied immediately?
Keep NVMe I/O requests through the mpt3sas driver at or below 2 MiB. The resolved behavior limits max_hw_sectors to the smaller of the device-reported MDTS and the 2 MiB driver limit.