CVE-2026-98088: scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()
In the Linux kernel, the following vulnerability has been resolved:
scsi: mpt3sas: Avoid out-of-bounds cpumaskofnode() call in baseassignreplyqueues()
devtonode() can return NUMANONODE (-1) on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose device-to-node affinity. Passing -1 directly into cpumaskofnode() indexes nodetocpumaskmap[-1], an out-of-bounds array read caught by UBSAN:
UBSAN: array-index-out-of-bounds in arch/x86/include/asm/topology.h:72:28 index -1 is out of range for type 'cpumask [1024]'
Fall back to cpuonlinemask when no NUMA node is available, rather than assuming devtonode() always returns a valid node index.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In scsi: mpt3sas _base_assign_reply_queues(), fall back to cpu_online_mask when dev_to_node() returns NUMA_NO_NODE (-1), rather than passing -1 to cpumask_of_node().
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel mpt3sas SCSI driver are affected when the PCI device has no NUMA-node affinity information. The described example is a single-socket board that does not expose device-to-node topology.
What condition triggers the out-of-bounds access?
The issue is triggered when dev_to_node() returns NUMA_NO_NODE (-1) and _base_assign_reply_queues() passes that value to cpumask_of_node(). This causes an access to node_to_cpumask_map[-1].
What is the mitigation if an update cannot be applied immediately?
The provided data does not describe a configuration workaround. The implemented fix falls back to cpu_online_mask when no NUMA node is available, avoiding the invalid cpumask_of_node() call.
How can I identify that the issue has occurred?
UBSAN can report an array-index-out-of-bounds warning in arch/x86/include/asm/topology.h, indicating index -1 is outside the node_to_cpumask_map array bounds.