The vulnerability lies in the Linux mpi3mr driver for SCSI devices. This represents a Null Pointer Dereference vulnerability (CWE-476). The function that allocates a SAS port may return NULL when memory cannot be allocated. That pointer is then passed to sas_port_add() without validation, causing a null pointer dereference and a kernel crash. The same code path also leaks a port structure if sas_port_add() fails. The likely attack vector is local, requiring the attacker to trigger a memory allocation failure in the SCSI subsystem, typically by performing an operation that forces the driver to add a SAS port.

All Linux kernel versions that include the MPI3MR driver for SCSI devices are affected until the patch that checks for NULL pointers and frees leaked resources is merged. The vulnerability applies to any system running the Linux kernel and loading or using the mpi3mr module, typically servers or storage controllers handling SAS or SATA devices.

The CVSS base score of 5.5 reflects medium severity. EPSS <1% and absence from the KEV catalog suggest that exploitation is unlikely at present. The attack requires local access that can induce a failure in the SCSI subsystem, so the attack vector is local. A successful exploit would cause a kernel crash, resulting in denial of service, though no privilege escalation path has been identified in the advisory.