CVE-2026-98129: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
In the Linux kernel, the following vulnerability has been resolved:
scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd()
sasportallocnum() can return NULL on memory allocation failure. The return value is passed directly to sasportadd() without a NULL check, which causes a NULL pointer dereference.
Additionally, if sasportadd() fails, the allocated port is not freed before jumping to outfail, leaking the sasport structure. Call sasportfree() to properly release it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.115-2~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Check the return value of sas_port_alloc_num() for NULL before passing it to sas_port_add() in mpi3mr_sas_port_add().
- Compensating control
If sas_port_add() fails, call sas_port_free() before jumping to out_fail to release the allocated sas_port structure.
Event History
Frequently Asked Questions
Under what condition can the NULL pointer dereference occur?
It can occur when sas_port_alloc_num() fails due to a memory-allocation failure and returns NULL. The vulnerable code passes that NULL return value to sas_port_add() without first checking it.
Is there also a resource-management issue on error paths?
Yes. If sas_port_add() fails after a SAS port has been allocated, the allocated sas_port structure was not freed before the failure path, causing a memory leak. The fix releases it with sas_port_free().
How can this be remediated?
Apply a Linux kernel update containing the fix. The provided stable kernel references identify commits carrying the correction.