Linux Kernel Vulnerability in Megaraid Driver Affects NVMe Request Handling

CVE-2026-90008

What is CVE-2026-90008?

A significant vulnerability exists in the Linux kernel's megaraid_sas driver concerning the handling of NVMe request sizes. This flaw can lead to a buffer overrun due to improper validation of the command's PRP list, which is built without enforcing boundary checks on the DMA pool buffer. When the buffer limit is exceeded, it risks corrupting adjacent memory spaces that may be associated with other active commands. This behavior can potentially lead to system instability and data corruption, emphasizing the critical importance of applying available patches to mitigate these risks.

References