The flaw resides in the Linux mpi3mr driver when the function that allocates SCSI port structures fails and returns a null pointer. That null pointer is passed to an add routine without validation, causing a NULL pointer dereference (CWE‑476). A kernel panic results from the crash, and if the add routine fails the partially allocated structure is not freed, creating a memory leak (CWE‑578). An attacker who can force these failure conditions can cause the kernel to crash, potentially allowing local privilege escalation to root after the crash.

All Linux kernel versions that ship the mpi3mr driver are susceptible until the commit referenced in the advisory is merged. The kernel CPE string identifies the entire Linux kernel family. Systems that load the mpi3mr module—typically those that manage SAS or SATA devices—are directly affected. The vulnerability is present in every upstream release lacking the patch.

There is no EPSS score and the issue is not present in the CISA KEV catalog, implying that widespread exploitation is unlikely at present. Nonetheless, the CVSS base score is high because an unprivileged local user with write access to the device can trigger a crash. Exploitation would require local access; the attack vector is thus local. Immediate patching mitigates the risk.