CVE-2026-98088

A flaw was found in the Linux kernel's mpt3sas driver. On systems lacking Non-Uniform Memory Access (NUMA) topology information for a PCI device, the driver fails to validate the device node index before querying CPU affinity masks, resulting in an out-of-bounds array read. This issue can lead to kernel memory corruption, unexpected behavior, or a system crash resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because it requires local access on hosts equipped with specific SAS storage controller hardware that lack PCI NUMA node topology mapping, with the primary consequence being a denial of service. In typical Red Hat Enterprise Linux deployments, enterprise server platforms generally provide valid NUMA node affinity data, restricting the conditions under which this bug can manifest. Furthermore, the invalid memory read during queue configuration leads to a system panic or crash without enabling code execution or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.