CVE intelligence
CVE-2026-90202
Vulnerability intelligence
Published Sep 17, 2026 Sources checked Nov 11, 2026
N/A CVSS not listed Score unavailable
What this means
Review the available evidence
CVE-2026-90202. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.
What to do next Remediation and response
CISA KEV Not listed Based on the latest collected catalog
EPSS 0.2% Estimated 30-day exploitation probability
Ransomware use Not marked CISA KEV ransomware field
Threat actors 0 Source-linked actor relationships
Overview
What is CVE-2026-90202? In the Linux kernel, the following vulnerability has been resolved:
scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers
_base_release_memory_pools() unconditionally frees every ioc->pcie_sg_lookup[] entry, including ones the setup loop never allocated after a partial failure, causing a "bad dma" warning on debug kernels or a NULL pointer dereference otherwise.
Source: NVD
Sources Check the original records SecurityAlert keeps CVSS, KEV, EPSS, vendor guidance, and actor links separate so you can see where each fact came from.