Linux kernel mpi3mr: reset/task-management race dereferences an invalid reply queue ID and crashes the host

Impact

The mpi3mr driver lets a task-management thread walk reply queues while the controller reset thread is tearing them down. The reset path stores a sentinel queue ID (0xFFFF) that the other thread then uses as an index, reaching unallocated memory and panicking the host. On a GPU node this is a storage-controller-induced kernel panic: every running job on the box dies and the node comes back only after a full boot. The trigger is a controller reset racing with in-flight I/O, not attacker-supplied input, so treat this as a reliability and availability defect rather than a privilege-escalation path; NVD's 7.8 local vector reflects the generic kernel template, not a demonstrated local-root exploit. Nodes that do not use Broadcom tri-mode HBAs do not load this driver at all.

Who can reach it

No network path. Requires the mpi3mr driver to be in use and a controller reset to coincide with I/O or admin command processing; local users cannot directly request a controller reset without privilege, so the realistic trigger is a storage fault or firmware event.

What to do

Take the stable kernel update carrying the io_admin_reset_sync synchronisation fix (see the linked git commits for the branch-specific backports). Applying it means drain the node and reboot into the patched kernel - the driver cannot be hot-swapped while it owns the boot or data storage controller. No vendor mitigation exists short of the kernel patch; nodes without Broadcom tri-mode HBAs need no action.

References

Related entries

• Linux kernel (drivers/gpu/drm/xe): The error path of the Xe VRAM clear helper waits on a fence pointer that is onlyCVE-2025-37869 · Linux kernel (drivers/gpu/drm/xe)High
• Linux kernel (drivers/iommu): With iommufd, a tenant can change a passthrough device's IOMMU domain while MSICVE-2025-38062 · Linux kernel (drivers/iommu)High
• Linux kernel sockmap: backlog worker uses a freed socket when a mapped socket is closed concurrentlyCVE-2025-38154 · Linux kernel BPF sockmap (sk_psock_backlog use-after-free on sk_socket)High
• Linux kernel (net/tls): A BPF verdict that grows the scatterlist (bpf_msg_push_data) combined with a cork_bytes settingCVE-2025-38166 · Linux kernel (net/tls)High
• Linux kernel nvme-tcp (admin tag set leak on secure-concatenation setup failure): After the change that reconnects theCVE-2025-38209 · Linux kernel nvme-tcp (admin tag set leak on secure-concatenation setup failure)High
• Linux kernel megaraid_sas: invalid NUMA node index causes an out-of-bounds access during driver probeCVE-2025-38239 · Linux kernel megaraid_sas driver (MSI-X vector allocation node index)High