CVE-2026-90008
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, the megaraid_sas driver's megasas_make_prp_nvme() builds a command's PRP list in cmd->sg_frame without checking the buffer bound. After the default BLK_DEF_MAX_SECTORS_CAP was increased to 4 MiB, NVMe transfers require more entries than fit in the frame, causing an out-of-bounds write, a page fault, or silent corruption of a neighbouring DMA pool entry.
Risk Assessment
The vulnerability can cause kernel panics or silent corruption of other in-flight commands' PRP lists, leading to system unavailability or data corruption. It affects systems using MegaRAID controllers with NVMe drives on kernels with the newer default request size limit.
Recommendation
Update the Linux kernel to a version containing the fix that caps max_hw_sectors to what the PRP chain frame can describe. If updating is not possible, consider temporarily limiting NVMe request size for megaraid_sas controllers.
Related vulnerabilities
- CVE-2026-88800Critical
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce. The guard meant to protect roles with assigned users reads a different part of the request than the one selecting what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, permanently stripping every user of their capabilities.
- CVE-2026-120844Critical
Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) through 7.1.3 allows Privilege Escalation.
- CVE-2026-119516Critical
Deserialization of Untrusted Data vulnerability in Radius Booking — Booking Calendar for Appointments & Services through 1.0.20 allows Object Injection.
- CVE-2026-118423Critical
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
- CVE-2026-63774Critical
Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands.
- CVE-2026-63017Critical
Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators.
- CVE-2026-77596Critical
In Kubeflow Pipelines prior to 2.18.0, the multi-user HTTP endpoints for uploading pipelines and pipeline versions skip SubjectAccessReview when the target namespace is empty and REQUIRE_NAMESPACE_FOR_PIPELINES defaults to false. A low-privilege tenant can create shared pipelines or inject attacker-controlled versions into existing shared pipelines without the required write permission. If the API server is directly reachable without an authenticating proxy, an unauthenticated caller can exploit the same bypass.
- CVE-2026-119757Critical
BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND node. The exposed macaroon can be used to gain full control of the LND node, including moving funds, resulting in theft of funds.
- CVE-2026-111494Critical
The MatchPoint Android app incorrectly validates TLS certificates due to a TrustManager that accepts any certificate and a permissive hostname validator. The app also allows unencrypted HTTP traffic, enabling an attacker who intercepts traffic to read and modify communications, including credentials and personal data.
- CVE-2026-111490Critical
An insecure direct object reference (IDOR) vulnerability in the MatchPoint API relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and physical-access QR codes, as well as modification of third-party accounts, password changes, impersonation, and virtual balance transfers.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame megasas_make_prp_nvme() builds a command's PRP list in cmd->sg_frame, a DMA pool buffer of instance->max_chain_frame_sz bytes, spending one entry per NVMe page of the transfer plus one per page of the buffer for the chain pointer. The loop runs until the transfer is described and never checks the buffer bound. max_hw_sectors comes straight from the MDTS the firmware reports for the drive. On drives with a large MDTS the only thing keeping the list inside the buffer was the block layer default of 1280 KiB, which needs 320 entries, which fit into a 4 KiB frame as that holds 512. But since commit 9b8b84879d4a ("block: Increase BLK_DEF_MAX_SECTORS_CAP") that default is 4 MiB, and such a transfer needs 1025 entries, so the list runs a full page past the end of the frame: sd 1:0:1:0: [sdb] tag#630 page boundary ptr_sgl: 0x00000000ba62d13f BUG: unable to handle page fault for address: ff663bcb81e7c000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page RIP: 0010:megasas_build_and_issue_cmd_fusion+0xeaa/0x1870 [megaraid_sas] If the page after the frame happens to be mapped, the overrun does not fault but silently corrupts the neighbouring pool entry, which is another in-flight command's PRP list. Cap max_hw_sectors at what the chain frame can describe, less one page for transfers that do not start on a page boundary and so need one entry more. This is the megaraid_sas counterpart of commit 04631f55afc5 ("scsi: mpt3sas: Limit NVMe request size to 2 MiB"), but derives the limit from max_chain_frame_sz rather than hardcoding it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS