---
id: CVE-2026-98129
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()

  sas_port_alloc_num() can return NULL on memory allocation failure
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()

  sas_port_alloc_num() can return NULL on memory allocation failure. The
  return value is passed direc…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e22bae30667a7e74ed057e00fb6e8c79e0738de3 <
    5c50137ba11b6e20e7074303dae35ff58d5a0b6f
  - >-
    Linux >= e22bae30667a7e74ed057e00fb6e8c79e0738de3 <
    2f69ed909de9e3d46af9db7dd24b9b80dc31b5ec
  - >-
    Linux >= e22bae30667a7e74ed057e00fb6e8c79e0738de3 <
    5cb58b052cf09dd8e88d92c1d649b3eea5c95d4d
  - >-
    Linux >= e22bae30667a7e74ed057e00fb6e8c79e0738de3 <
    dba9e2181ca5e875f98b8b9b4535cdaab87dcb0d
  - Linux 6.1
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:44.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98129'
references:
  - url: 'https://git.kernel.org/stable/c/2f69ed909de9e3d46af9db7dd24b9b80dc31b5ec'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5c50137ba11b6e20e7074303dae35ff58d5a0b6f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/5cb58b052cf09dd8e88d92c1d649b3eea5c95d4d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dba9e2181ca5e875f98b8b9b4535cdaab87dcb0d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.813Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()

sas_port_alloc_num() can return NULL on memory allocation failure. The
return value is passed directly to sas_port_add() without a NULL check,
which causes a NULL pointer dereference.

Additionally, if sas_port_add() fails, the allocated port is not freed
before jumping to out_fail, leaking the sas_port structure. Call
sas_port_free() to properly release it.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.