Linux Kernel CVE-2026-98129

Requires the mpi3mr driver to be loaded, which means the host must have a Broadcom/LSI MPI 3.0 tri-mode SAS/SATA HBA present. The specific trigger is a kernel memory allocation failure causing sas_port_alloc_num() to return NULL during mpi3mr_sas_port_add() (the secondary leak path requires sas_port_add() itself to fail). Limiting factors that reduce realistic risk: the vector is local only (AV:L), it affects only systems with this specific storage hardware/driver, the triggering allocation failure is not normally attacker-controlled (so it typically manifests under memory pressure at device discovery/hotplug rather than on demand), and impact is confined to a kernel crash (denial of service) with no confidentiality or integrity effect.

This is a medium-severity Linux kernel robustness fix, not a high-priority emergency. The signals are consistent and point to low real-world risk: the NVD CVSS is 5.5 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - local attack vector, low privileges, no confidentiality or integrity impact, and availability-only impact (a kernel crash). EPSS is 0.17% (5th percentile), i.e. very low exploitation probability, which aligns with the absence of a CISA KEV listing and no public exploit reference in the input. No SSVC decision fields (exploitation status, automatable, technical impact) were supplied, so that framework cannot be cross-referenced; the only priority signal provided is the vuln.today 'this_month' label, which is a routine-patching cadence, not act_now/emergency. One discrepancy worth verifying with the vendor: NVD assigns AC:L, but the description states the NULL dereference occurs specifically 'on memory allocation failure' in sas_port_alloc_num() - an allocation failure is not normally under attacker control, which argues for higher attack complexity and weaker local triggerability than AC:L implies. Overall this reads as a defensive hardening patch for a specific storage driver rather than a widely exploitable flaw.

On a system using the mpi3mr driver (Broadcom/LSI MPI 3.0 tri-mode SAS/SATA HBA), a kernel memory allocation failure during SAS port addition causes sas_port_alloc_num() to return NULL; because the result is passed to sas_port_add() without a NULL check, the kernel dereferences the NULL pointer and panics, producing a denial of service. Realistically this surfaces under memory pressure during device discovery or hotplug rather than through direct attacker control. No public exploit was identified at time of analysis.