CVE-2026-98128 Linux CVE debrief

Who should care

Linux kernel maintainers, administrators, and users of systems with the scsi: mpi3mr component should verify Linux kernel version and scsi: mpi3mr component configuration to ensure patch application, monitor system logs for potential issues related to target device refcount leak, and assess exposure based on their specific Linux kernel version and configuration.

Why it matters

A vulnerability in the Linux kernel's scsi: mpi3mr component can cause a target device refcount leak, potentially preventing the target device structure from being freed. Defenders should verify and apply patches, monitor system logs, and assess exposure based on their specific Linux kernel version and configuration.

• Verify Linux kernel version and scsi: mpi3mr component configuration to ensure patch application
• Monitor system logs for potential issues related to target device refcount leak

Technical summary

The Linux kernel's scsi: mpi3mr component has a vulnerability that can cause a target device refcount leak. This occurs when mpi3mr_sas_port_add() acquires a reference to a target device using mpi3mr_get_tgtdev_by_addr(), but fails to release it in case of an error. The issue is resolved by adding a tgtdev put in the out_fail path, guarded by a NULL check. This fix prevents the target device structure from being freed, addressing the vulnerability in the Linux kernel's scsi: mpi3mr component. Defenders should focus on verifying and applying patches for the Linux kernel scsi: mpi3mr component.

Defensive priority

Verify and apply patches for Linux kernel scsi: mpi3mr component

Recommended defensive actions

• Verify Linux kernel version and scsi: mpi3mr component configuration
• Apply patches from kernel.org
• Monitor system logs for potential issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references indicate a refcount leak in the Linux kernel's scsi: mpi3mr component. However, details on exploitation, impact, and affected versions are limited. Defenders should verify Linux kernel version and scsi: mpi3mr component configuration, apply patches from kernel.org, and monitor system logs for potential issues related to target device refcount leak.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.