CVE-2026-46105: Linux Kernel mpt3sas Driver DoS Flaw

CVE-2026-46105 Overview

CVE-2026-46105 is a Linux kernel vulnerability in the mpt3sas SCSI driver. The driver allocates a fixed 4 KiB buffer for the Physical Region Page (PRP) list, which accommodates at most 512 entries. This limits the supported maximum I/O transfer size to 2 MiB. However, the Host Bus Adapter (HBA) firmware reports NVMe Maximum Data Transfer Size (MDTS) values based on the underlying drive capability, which may exceed 2 MiB. Issuing oversized I/O requests can lead to a kernel oops. The fix limits max_hw_sectors to the smaller of the reported MDTS and the 2 MiB driver limit.

Critical Impact
Local workloads triggering large NVMe I/O through mpt3sas-attached drives can cause a kernel oops, resulting in denial of service on the affected system.

Affected Products

Linux kernel versions containing the mpt3sas SCSI driver prior to the upstream fix
Systems using Broadcom/LSI SAS HBA controllers managed by mpt3sas with attached NVMe drives
Stable kernel branches addressed by commits 04631f55afc5, 45dcc815fc55, and e5f9824817c6

Discovery Timeline

2026-05-28 - CVE-2026-46105 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46105

Vulnerability Analysis

The mpt3sas driver provides SCSI translation for NVMe drives attached to Broadcom MegaRAID/SAS HBAs. NVMe transfers use Physical Region Page (PRP) lists to describe scatter-gather buffers for DMA. The driver pre-allocates a single 4 KiB page for each PRP list, which can hold at most 512 8-byte PRP entries. With a typical 4 KiB page size per entry, this caps the practical I/O size at 2 MiB per command.

Firmware queries the underlying NVMe drive and returns its native MDTS value to the host. Modern NVMe SSDs commonly advertise MDTS values that translate to transfer sizes well beyond 2 MiB. The driver previously honored that firmware-reported MDTS without clamping it against its own PRP buffer limit. When the block layer dispatched a transfer larger than the PRP list could describe, the driver dereferenced beyond the allocated region, triggering a kernel oops.

Root Cause

The root cause is a mismatch between the fixed-size PRP list buffer and the dynamic MDTS value reported by firmware. The driver did not enforce its internal 2 MiB ceiling on max_hw_sectors, allowing the block layer to issue commands the driver could not safely encode. This is a boundary condition error in capability reporting.

Attack Vector

Exploitation requires the ability to submit large block I/O on an affected device. A local user or workload that can issue sufficiently large reads or writes through the block layer, or a kernel path that emits large I/O, can trigger the oops. The condition manifests on systems that pair mpt3sas-managed HBAs with NVMe drives advertising MDTS values above the driver's 2 MiB limit. The fix in the upstream commits clamps max_hw_sectors to min(reported_MDTS, 2 MiB) before the block layer queues requests.

Verified code examples are not available. See the upstream patches for the exact change: Linux kernel commit 04631f55afc5, commit 45dcc815fc55, and commit e5f9824817c6.

Detection Methods for CVE-2026-46105

Indicators of Compromise

Kernel oops or BUG: messages in dmesg originating from mpt3sas functions during NVMe I/O
Unexpected SCSI command timeouts or aborts on NVMe devices attached to Broadcom SAS HBAs
System reboots or hangs correlated with large sequential read/write workloads on affected hardware

Detection Strategies

Inventory hosts running mpt3sas with attached NVMe drives by checking lsmod | grep mpt3sas and lsblk -d -o name,tran
Compare /sys/block/<dev>/queue/max_hw_sectors_kb against 2048 KiB on unpatched kernels to identify systems reporting unsafe transfer ceilings
Correlate kernel crash dumps against the _base_build_nvme_prp and related PRP construction paths in mpt3sas

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a centralized logging platform and alert on mpt3sas oops signatures
Track running kernel versions across the fleet and flag hosts that have not received the patched build
Monitor storage subsystem health metrics for I/O timeouts on affected HBAs as an early indicator of the condition

How to Mitigate CVE-2026-46105

Immediate Actions Required

Apply the patched Linux kernel containing commits 04631f55afc5, 45dcc815fc55, or e5f9824817c6 from the relevant stable branch
Audit fleet inventory for systems combining mpt3sas HBAs with NVMe drives and prioritize those for patching
Restrict untrusted local workloads on affected hosts until kernels are updated

Patch Information

The upstream fix limits max_hw_sectors to the smaller of the firmware-reported MDTS and the driver's 2 MiB ceiling. Apply the patched kernel from your distribution or rebuild from the stable tree using one of the following references: Linux kernel commit 04631f55afc5, Linux kernel commit 45dcc815fc55, and Linux kernel commit e5f9824817c6.

Workarounds

Manually cap the block device transfer ceiling by writing a value of 2048 or less to /sys/block/<dev>/queue/max_hw_sectors_kb where permitted by the running kernel
Avoid issuing single I/O requests larger than 2 MiB to affected devices from application or filesystem layers until the patch is deployed
Schedule reboots into patched kernels during the next maintenance window for any host that cannot be tuned at runtime

bash

# Configuration example: clamp transfer size on an affected block device
for dev in /sys/block/sd*/queue/max_hw_sectors_kb; do
    current=$(cat "$dev")
    if [ "$current" -gt 2048 ]; then
        echo 2048 > "$dev"
    fi
done