A negative value returned by dev_to_node() was passed to cpumask_of_node(), resulting in the kernel reading beyond the node_to_cpumask_map array. This array index error was caught by UBSAN but could be exploited to read unintended kernel memory or cause a fault, potentially allowing privilege escalation or denial of service.

The flaw is present in the Linux kernel’s mpt3sas driver. All kernel releases that include the mpt3sas module—typically those distributed by the Linux community—could be affected, regardless of the hardware platform, because the driver logic is shared across distributions.

The vulnerability requires interaction with a SAS host bus adapter that triggers the reply‑queue assignment routine. No public exploit is available, and no count in the EPSS score is reported, but the failure can occur with local privileged users or automated drivers. The issue is not listed in CISA’s KEV catalog; however, the potential for a kernel panic or memory disclosure warrants prompt remediation.