CVE-2026-98128

Undergoing Analysis Undergoing Analysis - In Progress

Reference Leak in Linux Kernel mpi3mr Driver

Publication date: 2026-09-25

Last updated on: 2026-10-22

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() mpi3mr_get_tgtdev_by_addr() increments the target device kref when it returns a device. If a subsequent error triggers a goto out_fail after the tgtdev reference is acquired, the reference is never released because the out_fail path does not call mpi3mr_tgtdev_put(). This prevents the target device structure from ever being freed. Add a tgtdev put in the out_fail path, guarded by a NULL check since tgtdev is only acquired for SAS_END_DEVICE types and the same cleanup path is shared by earlier error cases where tgtdev is still NULL.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-22

Generated

2026-11-08

AI Q&A

2026-09-25

EPSS Evaluated

2026-11-07

NVD

CVE-2026-98128

EUVD

EUVD-2026-86959

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 7.2.7 (exc)
linux	linux_kernel	7.3
linux	linux_kernel	From 6.13 (inc) to 6.18.53 (exc)
linux	linux_kernel	From 6.1 (inc) to 6.12.111 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a reference count leak occurs in the mpi3mr driver. When a target device is acquired via mpi3mr_get_tgtdev_by_addr(), its reference count is incremented. If an error occurs later, the cleanup path fails to release this reference using mpi3mr_tgtdev_put(), preventing the device structure from ever being freed.

Detection Guidance

This vulnerability is specific to the Linux kernel's mpi3mr SCSI driver and involves a reference count leak in target device handling. Detection requires checking kernel logs for errors related to mpi3mr or SCSI devices, such as failed device additions or reference leaks. Commands like dmesg | grep mpi3mr or journalctl -k | grep mpi3mr may help identify issues.

Impact Analysis

This vulnerability could lead to a memory leak in the Linux kernel, potentially causing system instability or resource exhaustion over time. It may affect systems using the mpi3mr driver, particularly those with SAS storage devices.

Compliance Impact

This vulnerability involves a reference count leak in the Linux kernel's SCSI driver, which could lead to memory leaks but does not directly impact data privacy or security controls required by GDPR or HIPAA. Compliance with these standards typically depends on proper data handling, encryption, and access controls rather than kernel memory management issues.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for this vulnerability. Check your distribution's security advisories or kernel updates for a version containing the mpi3mr reference leak fix. Reboot the system after applying the update.

Hi! I’m here to help you understand CVE-2026-98128. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...