What’s Vulnerable › Vulnerabilities

CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-08 · updated 2026-06-17
• Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Add NULL checks when resetting request and reply queues The driver encountered a crash during resource cleanup when the reply and request queues were NULL due to freed memory. This issue occurred when the creation of reply or request queues failed, and the driver freed the memory first, but attempted to mem set the content of the freed memory, leading to a system crash. Add NULL pointer checks for reply and request queues before accessing the reply/request memory during cleanup

Affected products

• Linux kernel: from 5.17 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.19; from 6.19 before 6.19.9; 7.0-rc1 — fixed in 6.1.167, 6.12.78, 6.18.19, 6.19.9, 6.6.130

How to fix

Upgrade to a fixed version: Linux kernel 6.1.167, 6.12.78, 6.18.19, 6.19.9. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/220d7ca70611a73d50ef8e9edac630ed1ececb7c
• https://git.kernel.org/stable/c/78d3f201f8b609928eade53cf03a52df5415aaf7
• https://git.kernel.org/stable/c/7da755e0d02e9ca035065127e108d1fed8950dc8
• https://git.kernel.org/stable/c/7df0296ad4e9253d12c6dbe7f120044dddc95600
• https://git.kernel.org/stable/c/e978a36f332ede78eb4de037b517db16265d420d
• https://git.kernel.org/stable/c/fa96392ebebc8fade2b878acb14cce0f71016503

Get alerted when CVE-2026-43473 or the next vulnerability affects your stack