High 7.3Published Jan 11, 2025

CVE-2024-57804scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs

Updated under an hour ago (Oct 27, 2026, 9:50 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs The driver, through the SAS transport, exposes a sysfs interface to enable/disable PHYs in a controller/expander setup. When multiple PHYs are disabled and enabled in rapid succession, the persistent and current config pages related to SAS IO unit/SAS Expander pages could get corrupted. Use separate memory for each config request.

CVSS: 7.3 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 32d457d5a2af9bf5ddbe28297eabf1fc93451665 before d7dade716905b189f17cc1601cbb4b421a811a28; from 32d457d5a2af9bf5ddbe28297eabf1fc93451665 before 869fdc6f0606060301aef648231e186c7c542f5a; from 32d457d5a2af9bf5ddbe28297eabf1fc93451665 before 711201a8b8334a397440ac0b859df0054e174bc9	CNA record
linux linux_kernel linux:linux_kernel	from 6.1 before 6.12.8; 6.13	NVD

References

References

https://git.kernel.org/stable/c/d7dade716905b189f17cc1601cbb4b421a811a28
https://git.kernel.org/stable/c/869fdc6f0606060301aef648231e186c7c542f5a	patch
https://git.kernel.org/stable/c/711201a8b8334a397440ac0b859df0054e174bc9	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.