CVE-2026-98128

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpi3mr: Fix target device refcount leak in mpi3mr sas port add()

mpi3mr get tgtdev by addr() increments the target device kref when it returns a device. If a subsequent error triggers a goto out fail after the tgtdev reference is acquired, the reference is never released because the out fail path does not call mpi3mr tgtdev put(). This prevents the target device structure from ever being freed.

Add a tgtdev put in the out fail path, guarded by a NULL check since tgtdev is only acquired for SAS END DEVICE types and the same cleanup path is shared by earlier error cases where tgtdev is still NULL.