{"id":"CVE-2026-98088","revision":"803bb0715a0e4e3daa975182864f26b1","records":[{"revision":"803bb0715a0e4e3daa975182864f26b1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98088","aliases":[],"title":"scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()\n\ndev_to_node() can return NUMA_NO_NODE (-1) on systems without NUMA\ntopology information for the PCI device, such as single-socket boards\nthat don't expose device-to-node affinity. Passing -1 directly into\ncpumask_of_node() indexes node_to_cpumask_map[-1], an out-of-bounds\narray read caught by UBSAN:\n\n  UBSAN: array-index-out-of-bounds in arch/x86/include/asm/topology.h:72:28\n  index -1 is out of range for type 'cpumask *[1024]'\n\nFall back to cpu_online_mask when no NUMA node is available, rather than\nassuming dev_to_node() always returns a valid node index.","state":0,"publishedAt":"2026-09-25T10:24:22.278+00:00","modifiedAt":"2026-10-19T09:13:40.407+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/mpt3sas/mpt3sas_base.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"728bbc6cbff70051813730fb7977f5d99d867e12\",\n                            \"lessThan\": \"f531758ef21ba9a7716148cc290e8d9a110f20d9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"728bbc6cbff70051813730fb7977f5d99d867e12\",\n                            \"lessThan\": \"06a994ad7bbd13714cd45df582389f751531e60c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"728bbc6cbff70051813730fb7977f5d99d867e12\",\n                            \"lessThan\": \"7bcce856c79c1799351e170aec83e018ccf3d044\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"728bbc6cbff70051813730fb7977f5d99d867e12\",\n                            \"lessThan\": \"0a5f7cdb0cb911584720591069065f09c59ec4fc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"728bbc6cbff70051813730fb7977f5d99d867e12\",\n                            \"lessThan\": \"7b23144c3ff6e46d7d4a464b02f8944265684e39\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"728bbc6cbff70051813730fb7977f5d99d867e12\",\n                            \"lessThan\": \"45504e621b7e884abe59f201e093a3eac7fca7fe\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"728bbc6cbff70051813730fb7977f5d99d867e12\",\n                            \"lessThan\": \"e0d26fe176a8db6ccad4ab38c5bab29391c1946b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/mpt3sas/mpt3sas_base.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/f531758ef21ba9a7716148cc290e8d9a110f20d9","https://git.kernel.org/stable/c/06a994ad7bbd13714cd45df582389f751531e60c","https://git.kernel.org/stable/c/7bcce856c79c1799351e170aec83e018ccf3d044","https://git.kernel.org/stable/c/0a5f7cdb0cb911584720591069065f09c59ec4fc","https://git.kernel.org/stable/c/7b23144c3ff6e46d7d4a464b02f8944265684e39","https://git.kernel.org/stable/c/45504e621b7e884abe59f201e093a3eac7fca7fe","https://git.kernel.org/stable/c/e0d26fe176a8db6ccad4ab38c5bab29391c1946b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98088","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98088","identifiers":["CVE-2026-98088"]},"retained":false,"historicalAffected":[]}],"coverage":[]}