CVE-2026-98129

A flaw was found in the Linux kernel's mpi3mr SCSI driver. The driver fails to validate the return value of a memory allocation when adding a Serial Attached SCSI (SAS) port, leading to a NULL pointer dereference if the allocation fails. A local user could exploit this flaw under low-memory conditions to cause a kernel crash, resulting in a Denial of Service (DoS).

A low impact denial of service flaw was found in the Linux kernel's mpi3mr SCSI driver. When a SAS port is added, the return value of sas_port_alloc_num() is passed to sas_port_add() without a NULL check, so a memory allocation failure results in a NULL pointer dereference and a kernel crash. Exploiting this flaw requires local access on a system using the mpi3mr driver and depends on a memory allocation failing at the moment a SAS port is created, for example during SAS expander discovery or a SCSI rescan, which makes it most likely under low-memory conditions. The flaw affects only availability; confidentiality and integrity are not impacted. Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and OpenShift Container Platform releases built on RHEL CoreOS 9 are affected, while RHEL 6, RHEL 7, RHEL 8.4, RHEL 8.6, and OpenShift 4.12 (RHEL CoreOS 8) are not affected because the vulnerable code is not present. Because the impact is low and the flaw is difficult to trigger reliably, fixes for the affected releases have been deferred and will be delivered in a future update; the residual risk is a local kernel crash (denial of service) on systems using the mpi3mr driver. The upstream fix also frees the allocated sas_port structure when sas_port_add() fails, addressing a related memory leak.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.