---
id: CVE-2025-21723
title: 'scsi: mpi3mr: Fix possible crash when setting up bsg fails'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: mpi3mr: Fix possible crash when setting up bsg fails

  If bsg_setup_queue() fails, the bsg_queue is assigned a non-NULL value.
  Consequently, in mpi3mr_bsg_exit(), …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4268fa7513655a83d5492705591fdac6c65db48a <
    1ee558f98d9e247210e2301e19cc6e605778d4f1
  - >-
    Linux >= 4268fa7513655a83d5492705591fdac6c65db48a <
    bf66ec718e68767f6d463617adaf021963678803
  - >-
    Linux >= 4268fa7513655a83d5492705591fdac6c65db48a <
    19b248069d1b1424982723a2bf3941ad864d5204
  - >-
    Linux >= 4268fa7513655a83d5492705591fdac6c65db48a <
    832b8f95a2832321b8200ae478ed988b25faaef4
  - >-
    Linux >= 4268fa7513655a83d5492705591fdac6c65db48a <
    295006f6e8c17212d3098811166e29627d19e05c
  - Linux 5.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-10-01T20:08:33.491666Z'
published: '2025-02-27'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:20:46.798Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-21723'
references:
  - url: 'https://git.kernel.org/stable/c/1ee558f98d9e247210e2301e19cc6e605778d4f1'
  - url: 'https://git.kernel.org/stable/c/bf66ec718e68767f6d463617adaf021963678803'
  - url: 'https://git.kernel.org/stable/c/19b248069d1b1424982723a2bf3941ad864d5204'
  - url: 'https://git.kernel.org/stable/c/832b8f95a2832321b8200ae478ed988b25faaef4'
  - url: 'https://git.kernel.org/stable/c/295006f6e8c17212d3098811166e29627d19e05c'
tags:
  - cve.org
epss: 0.00259
epssPercentile: 0.1762
ingestedAt: '2026-10-21T12:48:53.719Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpi3mr: Fix possible crash when setting up bsg fails

If bsg_setup_queue() fails, the bsg_queue is assigned a non-NULL value.
Consequently, in mpi3mr_bsg_exit(), the condition "if(!mrioc->bsg_queue)"
will not be satisfied, preventing execution from entering
bsg_remove_queue(), which could lead to the following crash:

BUG: kernel NULL pointer dereference, address: 000000000000041c
Call Trace:
  <TASK>
  mpi3mr_bsg_exit+0x1f/0x50 [mpi3mr]
  mpi3mr_remove+0x6f/0x340 [mpi3mr]
  pci_device_remove+0x3f/0xb0
  device_release_driver_internal+0x19d/0x220
  unbind_store+0xa4/0xb0
  kernfs_fop_write_iter+0x11f/0x200
  vfs_write+0x1fc/0x3e0
  ksys_write+0x67/0xe0
  do_syscall_64+0x38/0x80
  entry_SYSCALL_64_after_hwframe+0x78/0xe2

## Affected

- `Linux >= 4268fa7513655a83d5492705591fdac6c65db48a < 1ee558f98d9e247210e2301e19cc6e605778d4f1`
- `Linux >= 4268fa7513655a83d5492705591fdac6c65db48a < bf66ec718e68767f6d463617adaf021963678803`
- `Linux >= 4268fa7513655a83d5492705591fdac6c65db48a < 19b248069d1b1424982723a2bf3941ad864d5204`
- `Linux >= 4268fa7513655a83d5492705591fdac6c65db48a < 832b8f95a2832321b8200ae478ed988b25faaef4`
- `Linux >= 4268fa7513655a83d5492705591fdac6c65db48a < 295006f6e8c17212d3098811166e29627d19e05c`
- `Linux 5.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.