CVE-2026-98129: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
In the Linux kernel, the following vulnerability has been resolved:
scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd()
sasportallocnum() can return NULL on memory allocation failure. The return value is passed directly to sasportadd() without a NULL check, which causes a NULL pointer dereference.
Additionally, if sasportadd() fails, the allocated port is not freed before jumping to outfail, leaking the sasport structure. Call sasportfree() to properly release it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In mpi3mr_sas_port_add(), NULL-check the sas_port_alloc_num() return value before passing it to sas_port_add(), and call sas_port_free() before jumping to out_fail when sas_port_add() fails so the allocated sas_port structure is released.
Event History
Frequently Asked Questions
Under what condition can the NULL pointer dereference occur?
It can occur when sas_port_alloc_num() fails due to a memory-allocation failure and returns NULL. The vulnerable code passes that NULL return value to sas_port_add() without first checking it.
Is there also a resource-management issue on error paths?
Yes. If sas_port_add() fails after a SAS port has been allocated, the allocated sas_port structure was not freed before the failure path, causing a memory leak. The fix releases it with sas_port_free().
How can this be remediated?
Apply a Linux kernel update containing the fix. The provided stable kernel references identify commits carrying the correction.