Linux kernel megaraid_sas: invalid NUMA node index causes an out-of-bounds access during driver probe

Impact

On systems with DRAM interleave enabled, megasas_alloc_irq_vectors() computes a node index of -1 and uses it against the per-node cpumask array, which UBSAN catches as array-index-out-of-bounds during PCI probe of the controller. The practical exposure is narrow: this happens at module load, driven by platform memory topology rather than by any attacker input, so it is a boot-path memory-safety defect on affected server configurations, not a path a tenant can reach. It is listed here because megaraid_sas is the boot and local-storage controller on a large share of GPU server platforms, so the fix rides along in whatever kernel update those nodes take next. Do not plan an emergency window for this one on the strength of the 7.8 score - that figure is NVD's generic kernel-template local vector, and no local trigger is described in the record.

Who can reach it

No remote or tenant path. Reached only when the megaraid_sas driver probes a controller on a host with DRAM interleave enabled; requires the ability to load the module or boot the machine.

What to do

Pick up the stable kernel that corrects the node index (five backports linked) at the next regular kernel maintenance - drain and reboot per node, no out-of-band window warranted. Disabling DRAM interleave in BIOS avoids the bad index but is a far more invasive change than the kernel update and will cost memory bandwidth.

References

Related entries

• Linux kernel (posix-cpu-timers): TOCTOU race between handle_posix_cpu_timers() and posix_cpu_timer_del()CVE-2025-38352 · Linux kernel (posix-cpu-timers)High
• Linux kernel virtio-net: unchecked received length in xdp_linearize_page allows an out-of-bounds readCVE-2025-38375 · Linux kernel virtio-net (xdp_linearize_page received-length check)High
• Linux i915 GPU kernel driver (GT timeline / VMA allocation): A timeline is left held when VMA allocation fails, soCVE-2025-38389 · Linux i915 GPU kernel driver (GT timeline / VMA allocation)High
• Linux kernel SMC (struct smc_sock type confusion with inet_sock): Struct smc_sock does not embed struct inet_sock asCVE-2025-38475 · Linux kernel SMC (struct smc_sock type confusion with inet_sock)High
• Linux kernel (net/xfrm): The guard that forbids changing a collect_md xfrm interface never fired, so a changelink putsCVE-2025-38500 · Linux kernel (net/xfrm)High
• Linux kernel (drivers/iommu/intel): VT-d tore the device off the I/O page-fault queue before the hardware had stoppedCVE-2025-38594 · Linux kernel (drivers/iommu/intel)High