Strix
64.9K

CVE-2026-98128

Unknown

Last modified

CVE-2026-98128 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() mpi3mr_get_tgtdev_by_addr() increments the target device kref when it returns a device. If a subsequent error triggers a goto out_fail after the tgtdev reference is acquired, the reference is never released because the out_fail path does not call mpi3mr_tgtdev_put().

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() mpi3mr_get_tgtdev_by_addr() increments the target device kref when it returns a device. If a subsequent error triggers a goto out_fail after the tgtdev reference is acquired, the reference is never released because the out_fail path does not call mpi3mr_tgtdev_put(). This prevents the target device structure from ever being freed. Add a tgtdev put in the out_fail path, guarded by a NULL check since tgtdev is only acquired for SAS_END_DEVICE types and the same cleanup path is shared by earlier error cases where tgtdev is still NULL.

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= e22bae30667a7e74ed057e00fb6e8c79e0738de3, < 040146f81d099006a354b0caacc7f01ca00f257e; >= e22bae30667a7e74ed057e00fb6e8c79e0738de3, < 06a7073b33b8f5cb0ee71e07dc669efffb1c7d58; >= e22bae30667a7e74ed057e00fb6e8c79e0738de3, < 1ccbe8c42009706af79e6629c70d42fc929aef2b; >= e22bae30667a7e74ed057e00fb6e8c79e0738de3, < 419d129f970aaa6567dbac366b0c93784bf9ec97
LinuxLinux6.1

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-98128?
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() mpi3mr_get_tgtdev_by_addr() increments the target device kref when it returns a device. If a subsequent error triggers a goto out_fail after the tgtdev reference is acquired, the reference is never released because the out_fail path does not call mpi3mr_tgtdev_put(). This prevents the target device structure from ever being freed. Add a tgtdev put in the out_fail path, guarded by a NULL check since tgtdev is only acquired for SAS_END_DEVICE types and the same cleanup path is shared by earlier error cases where tgtdev is still NULL.
How severe is CVE-2026-98128?
Severity scoring for CVE-2026-98128 is pending analysis.
How do I fix CVE-2026-98128?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-98128?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST