Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98128

scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() mpi3mr_get_tgtdev_by_addr() increments the target device kref when it returns a device. If a subsequent error triggers a goto out_fail after the tgtdev reference is acquired, the reference is never released because the out_fail path does not call mpi3mr_tgtdev_put(). This prevents the target device structure from ever being freed. Add a tgtdev put in the out_fail path, guarded by a NULL check since tgtdev is only acquired for SAS_END_DEVICE types and the same cleanup path is shared by earlier error cases where tgtdev is still NULL.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • e22bae30667a7e74ed057e00fb6e8c79e0738de3 to < 60a9aaac07f6470b252c4de40e7d8a6e25004093affected
  • e22bae30667a7e74ed057e00fb6e8c79e0738de3 to < 58e3d2fbc8c914ed3dce2f7d915b3c4f4a3c76fbaffected
  • e22bae30667a7e74ed057e00fb6e8c79e0738de3 to < 040146f81d099006a354b0caacc7f01ca00f257eaffected
  • e22bae30667a7e74ed057e00fb6e8c79e0738de3 to < 06a7073b33b8f5cb0ee71e07dc669efffb1c7d58affected
  • e22bae30667a7e74ed057e00fb6e8c79e0738de3 to < 1ccbe8c42009706af79e6629c70d42fc929aef2baffected
  • e22bae30667a7e74ed057e00fb6e8c79e0738de3 to < 419d129f970aaa6567dbac366b0c93784bf9ec97affected

Linux Linux

Default version status: affected

  • 6.1affected
  • 0 to < 6.1unaffected
  • 6.1.189 to ≤ 6.1.*unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.111 to ≤ 6.12.*unaffected
  • 6.18.53 to ≤ 6.18.*unaffected
  • 7.2.7 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References