High 7.8Published May 28, 2026

CVE-2026-46105scsi: mpt3sas: Limit NVMe request size to 2 MiB

Updated under an hour ago (Oct 27, 2026, 1:40 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Limit NVMe request size to 2 MiB The HBA firmware reports NVMe MDTS values based on the underlying drive capability. However, because the driver allocates a fixed 4K buffer for the PRP list, accommodating at most 512 entries, the driver supports a maximum I/O transfer size of 2 MiB. Limit max_hw_sectors to the smaller of the reported MDTS and the 2 MiB driver limit to prevent issuing oversized I/O that may lead to a kernel oops.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 9b8b84879d4adc506b0d3944e20b28d9f3f6994b before 45dcc815fc5539e88154315f36cbcb11d3a52fc2; from 9b8b84879d4adc506b0d3944e20b28d9f3f6994b before e5f9824817c6358b9f9738bdb92dec9e4e794d3c; from 9b8b84879d4adc506b0d3944e20b28d9f3f6994b before 04631f55afc543d5431a2bdee7f6cc0f2c0debe7	CNA record
linux linux_kernel linux:linux_kernel	from 6.17 before 6.18.30; from 6.19 before 7.0.7; 7.1; 7.1	NVD

References

References

https://git.kernel.org/stable/c/45dcc815fc5539e88154315f36cbcb11d3a52fc2	patch
https://git.kernel.org/stable/c/e5f9824817c6358b9f9738bdb92dec9e4e794d3c	patch
https://git.kernel.org/stable/c/04631f55afc543d5431a2bdee7f6cc0f2c0debe7	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.