CVE-2026-98088

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds cpumask Access in Linux Kernel mpt3sas Driver

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() dev_to_node() can return NUMA_NO_NODE (-1) on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose device-to-node affinity. Passing -1 directly into cpumask_of_node() indexes node_to_cpumask_map[-1], an out-of-bounds array read caught by UBSAN: UBSAN: array-index-out-of-bounds in arch/x86/include/asm/topology.h:72:28 index -1 is out of range for type 'cpumask *[1024]' Fall back to cpu_online_mask when no NUMA node is available, rather than assuming dev_to_node() always returns a valid node index.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98088

EUVD

EUVD-2026-86918

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves an out-of-bounds array read in the mpt3sas SCSI driver. When a system lacks NUMA topology information for a PCI device, dev_to_node() returns -1 (NUMA_NO_NODE). Passing this value to cpumask_of_node() causes an invalid array access, triggering a UBSAN error.

Detection Guidance

This vulnerability is specific to the Linux kernel's mpt3sas driver and may trigger UBSAN warnings. Check kernel logs for UBSAN errors related to array-index-out-of-bounds in the mpt3sas module. Use commands like dmesg | grep -i ubsan or journalctl -k | grep -i ubsan to inspect logs.

Impact Analysis

This vulnerability could cause system instability or crashes on affected Linux systems using the mpt3sas driver. It may lead to kernel panics or unexpected behavior when handling SCSI devices on single-socket systems without NUMA topology.

Compliance Impact

This vulnerability involves an out-of-bounds array read in the Linux kernel's SCSI driver, which could lead to undefined behavior or crashes. It does not directly impact data privacy or security controls required by standards like GDPR or HIPAA. However, if exploited, it might cause system instability affecting availability, which could indirectly impact compliance with availability-related requirements in these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for this issue. Monitor kernel logs for any related errors after applying the update. If using a custom kernel, ensure the mpt3sas driver is updated to address the out-of-bounds cpumask issue.

Hi! I’m here to help you understand CVE-2026-98088. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70