{"cve":"CVE-2026-43473","nvd":{"published":"2026-05-08T15:17:00.453","modified":"2026-06-17T10:49:45.870","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Add NULL checks when resetting request and reply queues\n\nThe driver encountered a crash during resource cleanup when the reply and\nrequest queues were NULL due to freed memory.  This issue occurred when the\ncreation of reply or request queues failed, and the driver freed the memory\nfirst, but attempted to mem set the content of the freed memory, leading to\na system crash.\n\nAdd NULL pointer checks for reply and request queues before accessing the\nreply/request memory during cleanup","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-476"],"references":["https://git.kernel.org/stable/c/220d7ca70611a73d50ef8e9edac630ed1ececb7c","https://git.kernel.org/stable/c/78d3f201f8b609928eade53cf03a52df5415aaf7","https://git.kernel.org/stable/c/7da755e0d02e9ca035065127e108d1fed8950dc8","https://git.kernel.org/stable/c/7df0296ad4e9253d12c6dbe7f120044dddc95600","https://git.kernel.org/stable/c/e978a36f332ede78eb4de037b517db16265d420d"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:33:55.586217763+00:00"},"epss":{"cve":"CVE-2026-43473","score":0.00114,"percentile":0.01475,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}