CVE-2026-46105: scsi: mpt3sas: Limit NVMe request size to 2 MiB

Synopsis

A missing bounds check in the Linux kernel's mpt3sas SCSI driver allows an attacker with a local, low-privilege account to issue oversized NVMe I/O requests, triggering a kernel oops. The driver allocates a fixed 4 KiB buffer for the PRP (Physical Region Page) list, supporting at most 512 entries and a 2 MiB transfer limit, but it did not enforce that ceiling against the MDTS value reported by the underlying drive firmware. Successful exploitation gives the attacker full read, write, and denial-of-service capability over the host kernel. A patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the vulnerable component is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the oversized I/O request; no administrative rights are needed.

• Victim interactionNot required

  No user interaction is needed; the attacker can trigger the kernel oops entirely through their own process.

• Attack complexityDetail

  The exploit is reliable and condition-free once local access is established; no race conditions or special memory layout are required.

Blast Radius

• Crashes the host kernel (oops), disrupting all workloads running on the affected node.
• Gains kernel-level write access, allowing modification of in-memory kernel structures and persisted data.
• Reads arbitrary kernel memory, exposing credentials, keys, and data belonging to co-resident processes.
• Can be chained with a local privilege escalation to achieve full root control of the host.