CVE-2026-72082: scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
In the Linux kernel, the following vulnerability has been resolved:
scsi: elx: efct: Fix refcount leak in efcthwioabort()
When efcthwreqtagalloc() fails in efcthwioabort(), the error path returns -ENOSPC without releasing the reference obtained via krefgetunlesszero() earlier in the function. All other error paths correctly drop the reference. This causes a permanent reference leak on the iotoabort object.
Additionally, the abortinprogress flag is left set to true on this path, which means future abort attempts for the same I/O will immediately return -EINPROGRESS even though the abort was never submitted, effectively blocking recovery.
Fix this by adding the missing krefput() call and reset abortinprogress to false, matching the cleanup done in the efcthwwqwrite() failure path below.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (scsi: elx: efct)to a version that resolves this vulnerability.Patch scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72082?
CVE-2026-72082 has a risk rating of 27, indicating a moderate level of severity in the Linux kernel.
How do I fix CVE-2026-72082?
To address CVE-2026-72082, ensure that you update your Linux kernel to the latest version where this vulnerability has been resolved.
What does CVE-2026-72082 affect?
CVE-2026-72082 affects the SCSI subsystem in the Linux kernel, specifically related to reference counting in the efct_hw_io_abort function.
What type of vulnerability is CVE-2026-72082?
CVE-2026-72082 is a reference count leak vulnerability that can lead to resource mismanagement in the Linux kernel.
When was CVE-2026-72082 published?
CVE-2026-72082 was published on August 15, 2026.