The mpi3mr SCSI driver in the Linux kernel suffered from a use‑after‑free condition during resource cleanup. When a reply or request queue could not be created, the driver freed the memory and later attempted to clear it with a memory set operation, causing a system crash. This flaw allowed a local attacker to trigger a denial‑of‑service by forcing a queue allocation failure during SCSI device removal.

All Linux kernel releases that compile the legacy mpi3mr driver and lack the added null‑check patch may be affected. No specific kernel version range was provided, so the issue could exist in any kernel revision prior to the upstream patch that introduced the guard.

Because the bug leads to an unhandled kernel crash, the primary impact is a denial‑of‑service. The flaw is local; it requires an attacker who can trigger a queue allocation failure, such as through a malicious SCSI device or local privilege. The CVSS score is 7.0, indicating a medium‑to‑high severity. EPSS data is not available and the vulnerability is not listed in CISA KEV, but the deterministic crash behavior and lack of safeguards make it a high‑risk issue.