In Linux, the mpt3sas SCSI driver allocates a fixed 4 KB PRP list buffer that can hold 512 entries, capping the maximum single I/O transfer to 2 MiB. The driver does not enforce this internal limit when the underlying NVMe device reports a larger maximum data transfer size (MDTS). If a request larger than 2 MiB is issued, the driver attempts to build a PRP list that overflows the allocated buffer, which can trigger a kernel oops and bring the host down. This vulnerability is a classic bounds‑check failure that directly compromises kernel integrity.

All Linux kernels that include the mpt3sas driver are affected, regardless of the vendor’s distribution. Any system that uses an HBA with mpt3sas support and connects to NVMe devices capable of reporting an MDTS larger than 2 MiB could be impacted. No specific kernel release is listed, so any kernel prior to the patch that implements the size check is potentially vulnerable.

The CVSS score is 5.5 and it is not listed in the CISA KEV catalog, indicating a moderate severity kernel crash. Based on the description, it is inferred that local or privileged users who can control the size of NVMe I/O requests could trigger the failure; remote exploitation would require a mechanism to influence such requests on the target machine. The EPSS score is 0.00017, indicating a very low probability of automated exploitation, but the specialized hardware context suggests the risk is low to moderate without active targeting.