---
id: CVE-2023-53124
title: 'scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()

  Port is allocated by sas_port_alloc_num() and rphy is allocated by either
  sas_end_device_alloc()…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d60000cb1195a464080b0efb4949daf7594e0020 <
    090305c36185c0547e4441d4c08f1cf096b32134
  - >-
    Linux >= ce1a69cc85006b494353911b35171da195d79e25 <
    6f0c2f70d9929208d8427ec72c3ed91e2251e289
  - >-
    Linux >= 6a92129c8f999ff5b122c100ce7f625eb3e98c4b <
    9937f784a608944107dcc2ba9a9c3333f8330b9e
  - >-
    Linux >= d17bca3ddfe507874cb826d32721552da12e741f <
    b5e5bbb3fa5f8412e96c5eda7f4a4af6241d6bd3
  - >-
    Linux >= 78316e9dfc24906dd474630928ed1d3c562b568e <
    a26c775ccc4cfe46f9b718b51bd24313053c7e0b
  - >-
    Linux >= 78316e9dfc24906dd474630928ed1d3c562b568e <
    d3c57724f1569311e4b81e98fad0931028b9bdcd
  - Linux 6f6768e2fc8638fabdd8802c2ef693d7aef01db1
  - Linux >= 5.4.229 < 5.4.238
  - Linux >= 5.10.163 < 5.10.176
  - Linux >= 5.15.86 < 5.15.104
  - Linux >= 6.1.2 < 6.1.21
  - Linux >= 6.0.16 < 6.1
  - Linux 6.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:18:19.279475Z'
published: '2025-05-02'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:21:03.236Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-53124'
references:
  - url: 'https://git.kernel.org/stable/c/090305c36185c0547e4441d4c08f1cf096b32134'
  - url: 'https://git.kernel.org/stable/c/6f0c2f70d9929208d8427ec72c3ed91e2251e289'
  - url: 'https://git.kernel.org/stable/c/9937f784a608944107dcc2ba9a9c3333f8330b9e'
  - url: 'https://git.kernel.org/stable/c/b5e5bbb3fa5f8412e96c5eda7f4a4af6241d6bd3'
  - url: 'https://git.kernel.org/stable/c/a26c775ccc4cfe46f9b718b51bd24313053c7e0b'
  - url: 'https://git.kernel.org/stable/c/d3c57724f1569311e4b81e98fad0931028b9bdcd'
tags:
  - cve.org
epss: 0.0019
epssPercentile: 0.08668
ingestedAt: '2026-11-05T22:38:31.774Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()

Port is allocated by sas_port_alloc_num() and rphy is allocated by either
sas_end_device_alloc() or sas_expander_alloc(), all of which may return
NULL. So we need to check the rphy to avoid possible NULL pointer access.

If sas_rphy_add() returned with failure, rphy is set to NULL. We would
access the rphy in the following lines which would also result NULL pointer
access.

## Affected

- `Linux >= d60000cb1195a464080b0efb4949daf7594e0020 < 090305c36185c0547e4441d4c08f1cf096b32134`
- `Linux >= ce1a69cc85006b494353911b35171da195d79e25 < 6f0c2f70d9929208d8427ec72c3ed91e2251e289`
- `Linux >= 6a92129c8f999ff5b122c100ce7f625eb3e98c4b < 9937f784a608944107dcc2ba9a9c3333f8330b9e`
- `Linux >= d17bca3ddfe507874cb826d32721552da12e741f < b5e5bbb3fa5f8412e96c5eda7f4a4af6241d6bd3`
- `Linux >= 78316e9dfc24906dd474630928ed1d3c562b568e < a26c775ccc4cfe46f9b718b51bd24313053c7e0b`
- `Linux >= 78316e9dfc24906dd474630928ed1d3c562b568e < d3c57724f1569311e4b81e98fad0931028b9bdcd`
- `Linux 6f6768e2fc8638fabdd8802c2ef693d7aef01db1`
- `Linux >= 5.4.229 < 5.4.238`
- `Linux >= 5.10.163 < 5.10.176`
- `Linux >= 5.15.86 < 5.15.104`
- `Linux >= 6.1.2 < 6.1.21`
- `Linux >= 6.0.16 < 6.1`
- `Linux 6.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.