{"id":"CVE-2026-90202","revision":"22e8b469847a4c099eeaa814e0159e52","records":[{"revision":"22e8b469847a4c099eeaa814e0159e52","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90202","aliases":[],"title":"scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers\n\n_base_release_memory_pools() unconditionally frees every\nioc->pcie_sg_lookup[] entry, including ones the setup loop never\nallocated after a partial failure, causing a \"bad dma\" warning on debug\nkernels or a NULL pointer dereference otherwise.","state":0,"publishedAt":"2026-09-17T16:07:19.514+00:00","modifiedAt":"2026-10-19T08:59:38.353+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/mpt3sas/mpt3sas_base.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"dbec4c9040edc15442c3ebdb65408aa9d3b82c24\",\n                            \"lessThan\": \"3361709fb6f6568b157c6f24ed21a4a5d86d73db\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dbec4c9040edc15442c3ebdb65408aa9d3b82c24\",\n                            \"lessThan\": \"240b582b6372bebb1245d911add9954b7dd6c02d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dbec4c9040edc15442c3ebdb65408aa9d3b82c24\",\n                            \"lessThan\": \"a61181f9ee30a98d2350c1bff32954a7521f9a23\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dbec4c9040edc15442c3ebdb65408aa9d3b82c24\",\n                            \"lessThan\": \"afedf35df054bd713e9e13771aa0a056932c5c67\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dbec4c9040edc15442c3ebdb65408aa9d3b82c24\",\n                            \"lessThan\": \"bc3398db3b64729b4a7907af317daad04795ad40\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dbec4c9040edc15442c3ebdb65408aa9d3b82c24\",\n                            \"lessThan\": \"2dbdd025b228110ccbfbab95fe16e098313a14af\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dbec4c9040edc15442c3ebdb65408aa9d3b82c24\",\n                            \"lessThan\": \"e2cd23443d3616ea0876f27762b17e2ec67d896c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dbec4c9040edc15442c3ebdb65408aa9d3b82c24\",\n                            \"lessThan\": \"b9f679dfe629004b593f018df33b330d799bcee4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/mpt3sas/mpt3sas_base.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.270\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.221\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.188\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.157\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.110\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/3361709fb6f6568b157c6f24ed21a4a5d86d73db","https://git.kernel.org/stable/c/240b582b6372bebb1245d911add9954b7dd6c02d","https://git.kernel.org/stable/c/a61181f9ee30a98d2350c1bff32954a7521f9a23","https://git.kernel.org/stable/c/afedf35df054bd713e9e13771aa0a056932c5c67","https://git.kernel.org/stable/c/bc3398db3b64729b4a7907af317daad04795ad40","https://git.kernel.org/stable/c/2dbdd025b228110ccbfbab95fe16e098313a14af","https://git.kernel.org/stable/c/e2cd23443d3616ea0876f27762b17e2ec67d896c","https://git.kernel.org/stable/c/b9f679dfe629004b593f018df33b330d799bcee4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90202","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90202","identifiers":["CVE-2026-90202"]},"retained":false,"historicalAffected":[]}],"coverage":[]}