CVE-2023-53124

scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()

State: Published
Severity: Not scored
Published: May 2, 2025
Updated: May 23, 2026
Reserved: May 2, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()

Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access.

If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d60000cb1195a464080b0efb4949daf7594e0020 to before 090305c36185c0547e4441d4c08f1cf096b32134Affected ce1a69cc85006b494353911b35171da195d79e25 to before 6f0c2f70d9929208d8427ec72c3ed91e2251e289Affected 6a92129c8f999ff5b122c100ce7f625eb3e98c4b to before 9937f784a608944107dcc2ba9a9c3333f8330b9eAffected d17bca3ddfe507874cb826d32721552da12e741f to before b5e5bbb3fa5f8412e96c5eda7f4a4af6241d6bd3Affected 78316e9dfc24906dd474630928ed1d3c562b568e to before a26c775ccc4cfe46f9b718b51bd24313053c7e0bAffected 78316e9dfc24906dd474630928ed1d3c562b568e to before d3c57724f1569311e4b81e98fad0931028b9bdcdAffected 6f6768e2fc8638fabdd8802c2ef693d7aef01db1Affected 5.4.229 to before 5.4.238Affected 5.10.163 to before 5.10.176Affected 5.15.86 to before 5.15.104Affected 6.1.2 to before 6.1.21Affected 6.0.16 to before 6.1Affected
LinuxLinux	6.2Affected before 6.2Not affected 5.4.238 through 5.4.Not affected 5.10.176 through 5.10.Not affected 5.15.104 through 5.15.Not affected 6.1.21 through 6.1.Not affected 6.2.8 through 6.2.*Not affected 6.3 and laterNot affected

Product

Versions

LinuxLinux

d60000cb1195a464080b0efb4949daf7594e0020 to before 090305c36185c0547e4441d4c08f1cf096b32134Affected
ce1a69cc85006b494353911b35171da195d79e25 to before 6f0c2f70d9929208d8427ec72c3ed91e2251e289Affected
6a92129c8f999ff5b122c100ce7f625eb3e98c4b to before 9937f784a608944107dcc2ba9a9c3333f8330b9eAffected
d17bca3ddfe507874cb826d32721552da12e741f to before b5e5bbb3fa5f8412e96c5eda7f4a4af6241d6bd3Affected
78316e9dfc24906dd474630928ed1d3c562b568e to before a26c775ccc4cfe46f9b718b51bd24313053c7e0bAffected
78316e9dfc24906dd474630928ed1d3c562b568e to before d3c57724f1569311e4b81e98fad0931028b9bdcdAffected
6f6768e2fc8638fabdd8802c2ef693d7aef01db1Affected
5.4.229 to before 5.4.238Affected
5.10.163 to before 5.10.176Affected
5.15.86 to before 5.15.104Affected
6.1.2 to before 6.1.21Affected
6.0.16 to before 6.1Affected

LinuxLinux

6.2Affected
before 6.2Not affected
5.4.238 through 5.4.*Not affected
5.10.176 through 5.10.*Not affected
5.15.104 through 5.15.*Not affected
6.1.21 through 6.1.*Not affected
6.2.8 through 6.2.*Not affected
6.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.