CVE-2026-98088

scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()

dev_to_node() can return NUMA_NO_NODE (-1) on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose device-to-node affinity. Passing -1 directly into cpumask_of_node() indexes node_to_cpumask_map[-1], an out-of-bounds array read caught by UBSAN:

UBSAN: array-index-out-of-bounds in arch/x86/include/asm/topology.h:72:28 index -1 is out of range for type 'cpumask *[1024]'

Fall back to cpu_online_mask when no NUMA node is available, rather than assuming dev_to_node() always returns a valid node index.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	728bbc6cbff70051813730fb7977f5d99d867e12 to before f531758ef21ba9a7716148cc290e8d9a110f20d9Affected 728bbc6cbff70051813730fb7977f5d99d867e12 to before 06a994ad7bbd13714cd45df582389f751531e60cAffected 728bbc6cbff70051813730fb7977f5d99d867e12 to before 7bcce856c79c1799351e170aec83e018ccf3d044Affected 728bbc6cbff70051813730fb7977f5d99d867e12 to before 0a5f7cdb0cb911584720591069065f09c59ec4fcAffected 728bbc6cbff70051813730fb7977f5d99d867e12 to before 7b23144c3ff6e46d7d4a464b02f8944265684e39Affected 728bbc6cbff70051813730fb7977f5d99d867e12 to before 45504e621b7e884abe59f201e093a3eac7fca7feAffected 728bbc6cbff70051813730fb7977f5d99d867e12 to before e0d26fe176a8db6ccad4ab38c5bab29391c1946bAffected
LinuxLinux	5.3Affected before 5.3Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2.7 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

728bbc6cbff70051813730fb7977f5d99d867e12 to before f531758ef21ba9a7716148cc290e8d9a110f20d9Affected
728bbc6cbff70051813730fb7977f5d99d867e12 to before 06a994ad7bbd13714cd45df582389f751531e60cAffected
728bbc6cbff70051813730fb7977f5d99d867e12 to before 7bcce856c79c1799351e170aec83e018ccf3d044Affected
728bbc6cbff70051813730fb7977f5d99d867e12 to before 0a5f7cdb0cb911584720591069065f09c59ec4fcAffected
728bbc6cbff70051813730fb7977f5d99d867e12 to before 7b23144c3ff6e46d7d4a464b02f8944265684e39Affected
728bbc6cbff70051813730fb7977f5d99d867e12 to before 45504e621b7e884abe59f201e093a3eac7fca7feAffected
728bbc6cbff70051813730fb7977f5d99d867e12 to before e0d26fe176a8db6ccad4ab38c5bab29391c1946bAffected

LinuxLinux

5.3Affected
before 5.3Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.