scsi: mpi3mr: Add NULL checks when resetting request and reply queues (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.11 % · percentile 1 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Add NULL checks when resetting request and reply queues The driver encountered a crash during resource cleanup when the reply and request queues were NULL due to freed memory. This issue occurred when the creation of reply or request queues failed, and the driver freed the memory first, but attempted to mem set the content of the freed memory, leading to a system crash. Add NULL pointer checks for reply and request queues before accessing the reply/request memory during cleanup
Weaknesses (CWE)
- CWE-476 — NULL Pointer Dereference
References
- https://git.kernel.org/stable/c/7df0296ad4e9253d12c6dbe7f120044dddc95600
- https://git.kernel.org/stable/c/7da755e0d02e9ca035065127e108d1fed8950dc8
- https://git.kernel.org/stable/c/78d3f201f8b609928eade53cf03a52df5415aaf7
- https://git.kernel.org/stable/c/e978a36f332ede78eb4de037b517db16265d420d
- https://git.kernel.org/stable/c/220d7ca70611a73d50ef8e9edac630ed1ececb7c
- https://git.kernel.org/stable/c/fa96392ebebc8fade2b878acb14cce0f71016503
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-28779
- GCVE · GCVE-0-2026-43473
CERT-FR advisories
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1093 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1066 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1064 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0985 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0956 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0927 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.17 < 6.1.167cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.130cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.78cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.18.19cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 6.19.9cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected fe6db615156573d3f6a37564b8a590cb03bbaf25 < 7df0296ad4e9253d12c6dbe7f120044dddc95600 ; affected fe6db615156573d3f6a37564b8a590cb03bbaf25 < 7da755e0d02e9ca035065127e108d1fed8950dc8 ; affected fe6db615156573d3f6a37564b8a590cb03bbaf25 < 78d3f201f8b609928eade53cf03a52df5415aaf7 ; affected fe6db615156573d3f6a37564b8a590cb03bbaf25 < e978a36f332ede78eb4de037b517db16265d420d ; affected fe6db615156573d3f6a37564b8a590cb03bbaf25 < 220d7ca70611a73d50ef8e9edac630ed1ececb7c ; affected fe6db615156573d3f6a37564b8a590cb03bbaf25 < fa96392ebebc8fade2b878acb14cce0f71016503 |
| Linux · Linux | affected 5.17 ; unaffected 0 < 5.17 ; unaffected 6.1.167 ≤ 6.1.* ; unaffected 6.6.130 ≤ 6.6.* ; unaffected 6.12.78 ≤ 6.12.* ; unaffected 6.18.19 ≤ 6.18.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |