« Volver al listado

CVE-2026-98128

Estado: En análisisSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()

mpi3mr_get_tgtdev_by_addr() increments the target device kref when it returns a device. If a subsequent error triggers a goto out_fail after the tgtdev reference is acquired, the reference is never released because the out_fail path does not call mpi3mr_tgtdev_put(). This prevents the target device structure from ever being freed.

Add a tgtdev put in the out_fail path, guarded by a NULL check since tgtdev is only acquired for SAS_END_DEVICE types and the same cleanup path is shared by earlier error cases where tgtdev is still NULL.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98128",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "e22bae30667a7e74ed057e00fb6e8c79e0738de3",
              "lessThan": "60a9aaac07f6470b252c4de40e7d8a6e25004093",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e22bae30667a7e74ed057e00fb6e8c79e0738de3",
              "lessThan": "58e3d2fbc8c914ed3dce2f7d915b3c4f4a3c76fb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e22bae30667a7e74ed057e00fb6e8c79e0738de3",
              "lessThan": "040146f81d099006a354b0caacc7f01ca00f257e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e22bae30667a7e74ed057e00fb6e8c79e0738de3",
              "lessThan": "06a7073b33b8f5cb0ee71e07dc669efffb1c7d58",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e22bae30667a7e74ed057e00fb6e8c79e0738de3",
              "lessThan": "1ccbe8c42009706af79e6629c70d42fc929aef2b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e22bae30667a7e74ed057e00fb6e8c79e0738de3",
              "lessThan": "419d129f970aaa6567dbac366b0c93784bf9ec97",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/scsi/mpi3mr/mpi3mr_transport.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/scsi/mpi3mr/mpi3mr_transport.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:44.163",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/040146f81d099006a354b0caacc7f01ca00f257e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/06a7073b33b8f5cb0ee71e07dc669efffb1c7d58",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1ccbe8c42009706af79e6629c70d42fc929aef2b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/419d129f970aaa6567dbac366b0c93784bf9ec97",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/58e3d2fbc8c914ed3dce2f7d915b3c4f4a3c76fb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/60a9aaac07f6470b252c4de40e7d8a6e25004093",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Undergoing Analysis",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()\n\nmpi3mr_get_tgtdev_by_addr() increments the target device kref when it\nreturns a device. If a subsequent error triggers a goto out_fail after\nthe tgtdev reference is acquired, the reference is never released\nbecause the out_fail path does not call mpi3mr_tgtdev_put(). This\nprevents the target device structure from ever being freed.\n\nAdd a tgtdev put in the out_fail path, guarded by a NULL check since\ntgtdev is only acquired for SAS_END_DEVICE types and the same cleanup\npath is shared by earlier error cases where tgtdev is still NULL."
    }
  ],
  "lastModified": "2026-10-03T11:18:34.417",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}