CVE-2026-72082

Received Received - Intake

Refcount Leak in Linux Kernel SCSI efct Driver

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() When efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error path returns -ENOSPC without releasing the reference obtained via kref_get_unless_zero() earlier in the function. All other error paths correctly drop the reference. This causes a permanent reference leak on the io_to_abort object. Additionally, the abort_in_progress flag is left set to true on this path, which means future abort attempts for the same I/O will immediately return -EINPROGRESS even though the abort was never submitted, effectively blocking recovery. Fix this by adding the missing kref_put() call and reset abort_in_progress to false, matching the cleanup done in the efct_hw_wq_write() failure path below.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72082

EUVD

EUVD-2026-59040

Affected Vendors & Products

Vendor	Product	Version / Range
elx	efct	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a reference count leak in the Linux kernel's SCSI driver for Emulex (elx) efct devices. When a specific function fails to allocate a resource, it incorrectly returns an error without releasing a reference it had taken, causing a permanent leak. Additionally, a flag remains set, blocking future recovery attempts.

Detection Guidance

This vulnerability is specific to the Linux kernel's SCSI driver for Emulex (elx efct) and may not have direct detection commands. Monitor kernel logs for errors related to efct_hw_io_abort or refcount leaks in SCSI operations. Check for I/O abort failures or blocked recovery attempts in system logs.

Impact Analysis

This could lead to system instability or crashes due to resource exhaustion. It may also cause I/O operations to hang or fail permanently, disrupting storage operations and potentially leading to data loss or service outages.

Compliance Impact

This vulnerability causes a reference leak and improper state handling in the Linux kernel's SCSI driver, which could lead to system instability or denial of service. Such issues may impact compliance with standards requiring reliable data processing and availability, such as GDPR's integrity principle or HIPAA's availability requirements, by potentially disrupting critical system operations.

Mitigation Strategies

Apply the latest Linux kernel update that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling the elx efct driver if not in use. Monitor system logs for signs of exploitation or abnormal behavior.

Hi! I’m here to help you understand CVE-2026-72082. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70