Security readout for executives and security teams
Plain-English summary
A Linux storage-driver flaw can allow an oversized NVMe I/O request to exceed the mpt3sas driver's fixed request-mapping capacity, potentially causing a kernel oops. The result may be a server crash or serious disruption. The supplied CVSS score is 7.8, but the sources do not establish real-world exploitation.
Executive priority
Treat this as a high-priority reliability and security update for affected storage servers, especially clustered, database, virtualization, or other outage-sensitive systems. It is not supported as an internet-scale emergency because exploitation is local and no active exploitation is cited. Quickly identify mpt3sas deployments, then follow distributor patch guidance.
Technical view
mpt3sas trusts firmware-reported NVMe MDTS despite allocating a fixed 4 KiB PRP-list buffer supporting 512 entries and at most 2 MiB transfers. Requests above that driver limit may overrun its supported mapping and trigger a kernel oops. The published fix caps max_hw_sectors at the smaller of MDTS and 2 MiB.
Likely exposure
Exposure is limited to affected Linux kernels using the mpt3sas driver with NVMe storage behind a relevant HBA. The supplied record lists 6.17, 6.18.30, 7.0.7, and 7.1 as affected, but does not clearly define complete version ranges. Distributor backports may change actual status.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges and no user interaction. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation, public exploit code, or remote reachability. The confirmed failure outcome is a kernel oops.
Researcher notes
The direct evidence establishes a size-limit mismatch and possible kernel oops. Although CVSS assigns high confidentiality, integrity, and availability impacts, the supplied technical description does not demonstrate data disclosure, code execution, or corruption. Exact affected-version boundaries and introduction history are insufficiently clear, so assess distributor kernels by fix inclusion rather than version alone.
Mitigation direction
- Update to a vendor-supported kernel containing the cited mpt3sas fix.
- Confirm the update caps mpt3sas NVMe transfers at 2 MiB.
- Prioritize storage hosts where crashes would disrupt critical services.
- Consult the Linux distributor's advisory for backport and package details.
Validation and detection
- Inventory hosts loading mpt3sas and using NVMe storage through its HBA.
- Record each host's kernel version, package release, and distributor.
- Verify package changelogs include one of the cited stable commits or equivalent fix.
- After updating, confirm normal storage operation and review logs for kernel oops events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-46105 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/45dcc815fc5539e88154315f36cbcb11d3a52fc2CVE reference, Linux
- https://git.kernel.org/stable/c/e5f9824817c6358b9f9738bdb92dec9e4e794d3cCVE reference, Linux
- https://git.kernel.org/stable/c/04631f55afc543d5431a2bdee7f6cc0f2c0debe7CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.