EUVD-2026-86959
GHSA-66fg-4xh5-8jcx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privileged access
-
DeliveryInduce SAS port add error path
-
ExploitLeak target device refcount
-
ExecutionAccumulate unfreed kernel structures
-
ImpactDegrade host availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Requires local access (AV:L) with at least low privileges (PR:L) on a Linux host that has the mpi3mr driver loaded, i.e. a system with a Broadcom MPI 3.0 SAS/SATA storage controller - the vulnerable code never runs on hosts without that hardware. The leak triggers only when mpi3mr_sas_port_add() hits an error reaching the out_fail path after a tgtdev reference has been acquired for a SAS_END_DEVICE. Limiting factors: no remote vector, no confidentiality/integrity impact, and the trigger is an internal SAS device-discovery error path that the available sources do not describe as directly attacker-controllable; meaningful impact requires repeated occurrences to accumulate a leak large enough to degrade availability. |
| Impact | This is a genuinely low-priority issue despite the 5.5 CVSS 'Medium' label. All signals point the same way: the CVSS vector is AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - purely local, requiring existing privileges, with no confidentiality or integrity impact, only availability. EPSS is 0.17% (5th percentile), the vulnerability is NOT on CISA KEV, and no confirmed working exploit code exists (the vuldb and NVD entries are advisory references, not verified exploits). The vuln.today decision label is 'this_month', not act_now or emergency, consistent with the low urgency. There is one notable conflict: the input Tags label this 'Information Disclosure', but the CVSS vector (C:N/I:N/A:H) and CWE-401 (memory leak) describe an availability/resource-exhaustion defect, not disclosure - the tag is mislabeled and should not drive triage. The underlying defect is a kernel refcount leak on an error path, which realistically causes slow memory exhaustion only on specific hardware, not a widely exploitable vulnerability. |
| Exploit ScenarioDerived | A local, low-privileged user on a Linux server equipped with a Broadcom MPI 3.0 SAS/SATA controller (mpi3mr driver) repeatedly induces the error condition in mpi3mr_sas_port_add() that occurs after a target-device reference is acquired for a SAS_END_DEVICE. Each occurrence leaks a target device structure that is never freed, slowly exhausting kernel memory and degrading host availability. No public exploit code exists, and the error trigger is internal to SAS device discovery rather than a described attacker-controlled input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
A target-device reference-count leak in the Linux kernel's mpi3mr SCSI driver can be triggered by a local user with low privileges on a host that has a Broadcom MPI 3.0 SAS/SATA controller and the mpi3mr driver loaded, causing kernel memory to be retained indefinitely. Each occurrence strands one target-device structure, so the flaw only becomes meaningful if the internal SAS device-discovery error path is reached repeatedly and enough memory accumulates to degrade availability; there is no confidentiality or integrity impact and no remote vector. Exploitation status is unconfirmed: no public exploit has been identified at time of analysis, it is not in CISA KEV, and EPSS is only 0.17% (5th percentile), consistent with a low-priority, hardware-dependent local defect rather than the 'Medium' 5.5 base score suggests. This is a genuinely low-priority issue despite the 5.5 CVSS label, and the trigger is not described in the available sources as directly attacker-controllable.
RemediationAI
Vendor-released patch: kernel 6.12.111, 6.18.53, 7.2.7 and 7.3-rc2 (and later) contain the fix, which adds a NULL-guarded mpi3mr_tgtdev_put() to the out_fail cleanup in mpi3mr_sas_port_add(); the corresponding upstream stable commits are https://git.kernel.org/stable/c/419d129f970aaa6567dbac366b0c93784bf9ec97, https://git.kernel.org/stable/c/040146f81d099006a354b0caacc7f01ca00f257e, https://git.kernel.org/stable/c/1ccbe8c42009706af79e6629c70d42fc929aef2b, https://git.kernel.org/stable/c/06a7073b33b8f5cb0ee71e07dc669efffb1c7d58 (plus 58e3d2fbc8c914ed3dce2f7d915b3c4f4a3c76fb and 60a9aaac07f6470b252c4de40e7d8a6e25004093). Apply the kernel update through the distribution vendor once it ships the patched stable point release; given the this_month priority, EPSS of 0.17% and the local, hardware-gated trigger, it can be scheduled in the normal monthly patch cycle rather than treated as an emergency. Distributors that have not yet rebased should backport the referenced commit. Hosts without a Broadcom MPI 3.0 controller or without the mpi3mr module loaded are not exposed and need no action beyond routine tracking; where the module is only needed intermittently, avoiding loading it removes exposure but also removes access to the attached SAS/SATA storage, and there is no other configuration-level fix - updating the kernel is the only complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The mpi3mr driver is the Linux SCSI low-level driver for Broadcom's MPI 3.0 family of SAS/SATA storage controllers (the successor to mpt3sas). The flaw is a CWE-401 missing-release-of-memory-after-effective-lifetime error built on the kernel's kref reference-counting idiom: mpi3mr_get_tgtdev_by_addr() takes a reference on the target device (tgtdev) structure before returning it, and mpi3mr_sas_port_add() is expected to drop that reference with mpi3mr_tgtdev_put() on every exit path. When a later step in port addition fails and jumps to the shared out_fail label after the tgtdev reference was taken, the reference is never released, so the structure can never be freed. Because the same out_fail cleanup is also reached by earlier error cases in which tgtdev has not yet been acquired (the reference is only taken for SAS_END_DEVICE type targets), the fix adds a NULL-guarded mpi3mr_tgtdev_put() in that path. The vulnerable code exists only on systems with the relevant Broadcom hardware and the driver bound, which is why the assessed vector is AV:L/AC:H/PR:L with availability-only impact (A:L) rather than the higher-severity framing of the original score.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local low-privileged access (AV:L/PR:L); the error path is not described as attacker-controlled so AC:H; a slow refcount leak degrades availability gradually, so A:L with no C/I impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
mpi3mr_get_tgtdev_by_addr() increments the target device kref when it returns a device. If a subsequent error triggers a goto out_fail after the tgtdev reference is acquired, the reference is never released because the out_fail path does not call mpi3mr_tgtdev_put(). This prevents the target device structure from ever being freed.
Add a tgtdev put in the out_fail path, guarded by a NULL check since tgtdev is only acquired for SAS_END_DEVICE types and the same cleanup path is shared by earlier error cases where tgtdev is still NULL.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB