CVE-2026-90008

A flaw was found in the Linux kernel's megaraid_sas component. The megasas_make_prp_nvme() function, which constructs a list of memory pages for data transfers, fails to verify the allocated buffer's boundaries. This can result in a buffer overrun, potentially leading to a system crash (Denial of Service) or silent corruption of data belonging to other active commands.

This vulnerability is rated as an Important impact because local unprivileged users performing large I/O requests could trigger a kernel buffer overrun, potentially leading to system instability, denial of service, or silent memory corruption. Exploitation requires the host to be equipped with MegaRAID SAS storage controllers managing NVMe devices that support large maximum data transfer sizes. Systems without this storage hardware or those not utilizing NVMe devices managed by this driver are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the megaraid_sas kernel module from loading if the hardware is not required.

1. Create a configuration file to disable the module:

echo "install megaraid_sas /bin/true" > /etc/modprobe.d/megaraid_sas.conf
echo "blacklist megaraid_sas" >> /etc/modprobe.d/megaraid_sas.conf

2. If the module is already loaded into memory, unload it:

modprobe -r megaraid_sas

Caveats:

• Disabling this driver prevents communication with MegaRAID SAS controllers. Do not apply this configuration if the host utilizes these controllers for essential storage or root filesystems, as it will make disks inaccessible and prevent booting.
• If the module is loaded during early boot via the initial ramdisk, rebuild the initramfs with dracut -f.
• A system restart is required for changes to take full effect if the driver cannot be unloaded while in use.