The mpi3mr SCSI driver in the Linux kernel suffered from a null pointer dereference and memory corruption (CWE-476, CWE-825) condition during resource cleanup. When a reply or request queue could not be created, the driver freed the memory and later attempted to clear it with a memory set operation, causing a system crash. This flaw allowed a local attacker to trigger a denial‑of‑service by forcing a queue allocation failure during SCSI device removal.

All Linux kernel releases that compile the legacy mpi3mr driver and lack the added null‑check patch may be affected. No specific kernel version range was provided, so the issue could exist in any kernel revision prior to the upstream patch that introduced the guard.

Because the bug leads to an unhandled kernel crash, the primary impact is a denial‑of‑service. The flaw is local; based on the description, it is inferred that an attacker must be able to trigger a queue allocation failure, for example by interacting with a malicious SCSI device or through local privilege. The CVSS score is 5.5, indicating a medium severity. The EPSS score is < 1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV, but the deterministic crash behavior and lack of safeguards make it a serious issue.