CVE-2026-90202: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
In the Linux kernel, the following vulnerability has been resolved:
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
basereleasememorypools() unconditionally frees every ioc->pciesglookup[] entry, including ones the setup loop never allocated after a partial failure, causing a "bad dma" warning on debug kernels or a NULL pointer dereference otherwise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Compensating control
If you cannot apply the kernel fix immediately, run systems with DMA/PCIe debug logging disabled to avoid the "bad dma" warning noise and monitor for NULL pointer dereference crashes.
Event History
Frequently Asked Questions
What condition is required to trigger the issue?
The PCIe SGL buffer setup must fail partway through allocation. During subsequent memory-pool cleanup, the driver can attempt to free lookup entries that were never allocated.
What are the likely effects on an affected system?
Debug kernels may report a "bad dma" warning. Other kernels may encounter a NULL pointer dereference during cleanup.
How can I tell whether a system has encountered this problem?
Look for a "bad dma" warning on a debug kernel or a NULL pointer dereference associated with mpt3sas memory-pool release after a partial PCIe SGL buffer allocation failure.