UBUNTU-CVE-2026-98128: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd() mpi3mrgettgtdevbyaddr() increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is acquired, the reference is never released because the outfail path does not call mpi3mrtgtdevput(). This prevents the target device structure from ever being freed. Add a tgtdev put in the outfail path, guarded by a NULL check since tgtdev is only acquired for SASENDDEVICE types and the same cleanup path is shared by earlier error cases where tgtdev is still NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In mpi3mr_sas_port_add(), add mpi3mr_tgtdev_put() to the out_fail cleanup path, guarded by a NULL check on tgtdev, so references acquired by mpi3mr_get_tgtdev_by_addr() are released without dereferencing NULL in earlier error paths.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The affected Ubuntu kernel packages listed are linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop. The issue is in the mpi3mr SCSI driver and involves SAS end-device handling.
What conditions are required to trigger the leak?
A target device reference must be acquired by mpi3mr_get_tgtdev_by_addr(), followed by an error that takes the mpi3mr_sas_port_add() out_fail path. The affected reference is acquired only for SAS_END_DEVICE types.
What is the practical impact if triggered?
The target device structure is not freed because its kref is never released. The provided severity vector rates availability impact as high, with no confidentiality or integrity impact.
How can I determine whether a system has encountered the issue?
The provided data identifies the failure condition as an error after target-device reference acquisition in mpi3mr_sas_port_add(). It does not provide a specific log message, diagnostic command, or observable indicator for confirming prior exploitation or leakage.