{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98128", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.318Z", "datePublished": "2026-09-25T10:36:09.014Z", "dateUpdated": "2026-09-25T10:36:09.014Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-25T10:36:09.014Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()\n\nmpi3mr_get_tgtdev_by_addr() increments the target device kref when it\nreturns a device. If a subsequent error triggers a goto out_fail after\nthe tgtdev reference is acquired, the reference is never released\nbecause the out_fail path does not call mpi3mr_tgtdev_put(). This\nprevents the target device structure from ever being freed.\n\nAdd a tgtdev put in the out_fail path, guarded by a NULL check since\ntgtdev is only acquired for SAS_END_DEVICE types and the same cleanup\npath is shared by earlier error cases where tgtdev is still NULL."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/mpi3mr/mpi3mr_transport.c"], "versions": [{"version": "e22bae30667a7e74ed057e00fb6e8c79e0738de3", "lessThan": "040146f81d099006a354b0caacc7f01ca00f257e", "status": "affected", "versionType": "git"}, {"version": "e22bae30667a7e74ed057e00fb6e8c79e0738de3", "lessThan": "06a7073b33b8f5cb0ee71e07dc669efffb1c7d58", "status": "affected", "versionType": "git"}, {"version": "e22bae30667a7e74ed057e00fb6e8c79e0738de3", "lessThan": "1ccbe8c42009706af79e6629c70d42fc929aef2b", "status": "affected", "versionType": "git"}, {"version": "e22bae30667a7e74ed057e00fb6e8c79e0738de3", "lessThan": "419d129f970aaa6567dbac366b0c93784bf9ec97", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/scsi/mpi3mr/mpi3mr_transport.c"], "versions": [{"version": "6.1", "status": "affected"}, {"version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.3-rc2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/040146f81d099006a354b0caacc7f01ca00f257e"}, {"url": "https://git.kernel.org/stable/c/06a7073b33b8f5cb0ee71e07dc669efffb1c7d58"}, {"url": "https://git.kernel.org/stable/c/1ccbe8c42009706af79e6629c70d42fc929aef2b"}, {"url": "https://git.kernel.org/stable/c/419d129f970aaa6567dbac366b0c93784bf9ec97"}], "title": "scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/scsi/mpi3mr/mpi3mr_transport.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "040146f81d099006a354b0caacc7f01ca00f257e", "status": "affected", "version": "e22bae30667a7e74ed057e00fb6e8c79e0738de3", "versionType": "git"}, {"lessThan": "06a7073b33b8f5cb0ee71e07dc669efffb1c7d58", "status": "affected", "version": "e22bae30667a7e74ed057e00fb6e8c79e0738de3", "versionType": "git"}, {"lessThan": "1ccbe8c42009706af79e6629c70d42fc929aef2b", "status": "affected", "version": "e22bae30667a7e74ed057e00fb6e8c79e0738de3", "versionType": "git"}, {"lessThan": "419d129f970aaa6567dbac366b0c93784bf9ec97", "status": "affected", "version": "e22bae30667a7e74ed057e00fb6e8c79e0738de3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/scsi/mpi3mr/mpi3mr_transport.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()\n\nmpi3mr_get_tgtdev_by_addr() increments the target device kref when it\nreturns a device. If a subsequent error triggers a goto out_fail after\nthe tgtdev reference is acquired, the reference is never released\nbecause the out_fail path does not call mpi3mr_tgtdev_put(). This\nprevents the target device structure from ever being freed.\n\nAdd a tgtdev put in the out_fail path, guarded by a NULL check since\ntgtdev is only acquired for SAS_END_DEVICE types and the same cleanup\npath is shared by earlier error cases where tgtdev is still NULL."}], "id": "CVE-2026-98128", "lastModified": "2026-09-25T11:17:44.163", "metrics": {}, "published": "2026-09-25T11:17:44.163", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/040146f81d099006a354b0caacc7f01ca00f257e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/06a7073b33b8f5cb0ee71e07dc669efffb1c7d58"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1ccbe8c42009706af79e6629c70d42fc929aef2b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/419d129f970aaa6567dbac366b0c93784bf9ec97"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()", "id": "2541376", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541376"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nscsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()\nmpi3mr_get_tgtdev_by_addr() increments the target device kref when it\nreturns a device. If a subsequent error triggers a goto out_fail after\nthe tgtdev reference is acquired, the reference is never released\nbecause the out_fail path does not call mpi3mr_tgtdev_put(). This\nprevents the target device structure from ever being freed.\nAdd a tgtdev put in the out_fail path, guarded by a NULL check since\ntgtdev is only acquired for SAS_END_DEVICE types and the same cleanup\npath is shared by earlier error cases where tgtdev is still NULL.", "A flaw was found in the Linux kernel's mpi3mr driver. This vulnerability can lead to a Denial of Service (DoS) due to kernel memory exhaustion. When an error occurs during Serial Attached SCSI (SAS) port addition, the driver fails to properly release an acquired reference count on the target device structure, preventing the allocated memory from being freed. A local user capable of triggering this error condition can cause repeated memory leaks, potentially degrading system performance or causing a system crash."], "name": "CVE-2026-98128", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98128\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98128\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98128.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e22bae30667a7e74ed057e00fb6e8c79e0738de3,040146f81d099006a354b0caacc7f01ca00f257e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e22bae30667a7e74ed057e00fb6e8c79e0738de3,06a7073b33b8f5cb0ee71e07dc669efffb1c7d58)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e22bae30667a7e74ed057e00fb6e8c79e0738de3,1ccbe8c42009706af79e6629c70d42fc929aef2b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e22bae30667a7e74ed057e00fb6e8c79e0738de3,419d129f970aaa6567dbac366b0c93784bf9ec97)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T12:30:08.709169+00:00", "updated": "2026-09-29T20:15:07.249131+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-401", "CWE-911"]}