CVE-2026-98128

A flaw was found in the Linux kernel's mpi3mr driver. This vulnerability can lead to a Denial of Service (DoS) due to kernel memory exhaustion. When an error occurs during Serial Attached SCSI (SAS) port addition, the driver fails to properly release an acquired reference count on the target device structure, preventing the allocated memory from being freed. A local user capable of triggering this error condition can cause repeated memory leaks, potentially degrading system performance or causing a system crash.

A low impact reference count leak was found in the mpi3mr SCSI driver of the Linux kernel as shipped in Red Hat Enterprise Linux. In mpi3mr_sas_port_add(), a target device reference acquired by mpi3mr_get_tgtdev_by_addr() is never released when a subsequent error jumps to the out_fail cleanup path, because that path does not call mpi3mr_tgtdev_put(). As a result, the target device structure is never freed. A local user able to trigger this error condition during Serial Attached SCSI (SAS) port addition could cause repeated kernel memory leaks, potentially degrading system performance or causing a system crash (denial of service). There is no impact on confidentiality or integrity.

Red Hat Product Security has rated this flaw Low impact, lower than the Moderate severity suggested by the Red Hat CVSS 3.1 base score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), because exploitation requires local privileged access to a system with an affected MPI3-based storage controller and depends on error conditions occurring during SAS port addition.

The vulnerable code is present in Red Hat Enterprise Linux 8 (from the 8.8 minor release onward), Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases built on RHEL CoreOS 9. Fixes for the affected streams have been deferred to future regularly scheduled updates because this is a low-impact memory leak; the residual risk is gradual kernel memory consumption and a potential denial of service on systems where the error path can be repeatedly triggered. Red Hat Enterprise Linux 6, 7, and 8.4/8.6, and OpenShift Container Platform 4.12 (built on RHEL CoreOS 8) are not affected because the vulnerable code is not present in those streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.