CVE-2026-98129
Received Received - Intake

NULL Pointer Dereference in Linux Kernel SCSI Driver

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() sas_port_alloc_num() can return NULL on memory allocation failure. The return value is passed directly to sas_port_add() without a NULL check, which causes a NULL pointer dereference. Additionally, if sas_port_add() fails, the allocated port is not freed before jumping to out_fail, leaking the sas_port structure. Call sas_port_free() to properly release it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98129
EUVD
EUVD-2026-86960

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a NULL pointer dereference in the Linux kernel's mpi3mr driver. It occurs when sas_port_alloc_num() fails to allocate memory and returns NULL, which is then passed to sas_port_add() without checking. This causes a crash. Additionally, if sas_port_add() fails, the allocated port is not freed, leading to a memory leak.

Detection Guidance

This vulnerability involves a NULL pointer dereference in the Linux kernel's mpi3mr driver. Detection requires checking for kernel logs or crashes related to the mpi3mr module or SAS port operations. Monitor system logs for errors like 'NULL pointer dereference' or 'sas_port_add() failed' in the kernel logs. Commands like dmesg | grep -i 'mpi3mr\|sas_port' or journalctl -k | grep -i 'mpi3mr\|sas_port' may help identify issues.

Impact Analysis

This vulnerability can cause system crashes or instability if the mpi3mr driver is used. It may lead to denial of service conditions or unexpected behavior in systems relying on SCSI devices. Memory leaks could also degrade system performance over time.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for this vulnerability. Check your distribution's security updates or kernel patches. If updating is not immediately possible, consider disabling the mpi3mr module if it is not required, using commands like sudo modprobe -r mpi3mr. Ensure proper memory allocation checks are in place in kernel modules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98129. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart