CVE-2026-98128: scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
In the Linux kernel, the following vulnerability has been resolved:
scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd()
mpi3mrgettgtdevbyaddr() increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is acquired, the reference is never released because the outfail path does not call mpi3mrtgtdevput(). This prevents the target device structure from ever being freed.
Add a tgtdev put in the outfail path, guarded by a NULL check since tgtdev is only acquired for SASENDDEVICE types and the same cleanup path is shared by earlier error cases where tgtdev is still NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In mpi3mr_sas_port_add(), add a NULL-guarded mpi3mr_tgtdev_put(tgtdev) in the out_fail cleanup path to release the target-device reference acquired by mpi3mr_get_tgtdev_by_addr().
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel mpi3mr SCSI driver are affected when the driver adds SAS end devices and encounters an error after acquiring a target-device reference. The issue is specific to the mpi3mr_sas_port_add() error path.
What is required to trigger the leak?
An error must occur after mpi3mr_get_tgtdev_by_addr() has returned a target device but before mpi3mr_sas_port_add() completes. The affected path applies to SAS_END_DEVICE types; earlier failures sharing the cleanup path do not acquire the target-device reference.
What is the impact if the issue is triggered repeatedly?
The target-device reference is not released, preventing its structure from being freed. Repeated triggering can retain target-device structures in memory.
How can the issue be remediated?
Apply a kernel update containing the referenced fix. The correction releases the acquired target-device reference in the out_fail cleanup path when the target-device pointer is non-NULL.