Strix
57.2K

CVE-2026-72082

UnknownEPSS 0.21%

Last modified

CVE-2026-72082 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() When efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error path returns -ENOSPC without releasing the reference obtained via kref_get_unless_zero() earlier in the function. All other error paths correctly drop the reference. EPSS estimates a 0.21% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() When efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error path returns -ENOSPC without releasing the reference obtained via kref_get_unless_zero() earlier in the function. All other error paths correctly drop the reference. This causes a permanent reference leak on the io_to_abort object. Additionally, the abort_in_progress flag is left set to true on this path, which means future abort attempts for the same I/O will immediately return -EINPROGRESS even though the abort was never submitted, effectively blocking recovery. Fix this by adding the missing kref_put() call and reset abort_in_progress to false, matching the cleanup done in the efct_hw_wq_write() failure path below.

Metrics

EPSS Probability
0.21%

12.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 63de51327a64c74e85611a0161eaae71256a3b6d, < cf97ea7b164a1881c7219f5222219c9d0fac4204; >= 63de51327a64c74e85611a0161eaae71256a3b6d, < 1c6e186c722cfa9a58ebe841f91ab2ddf8570cc7; >= 63de51327a64c74e85611a0161eaae71256a3b6d, < 62cf39a9770a6f29df59fd0edb0a05234a8b07f2; >= 63de51327a64c74e85611a0161eaae71256a3b6d, < faa59add4808fbf92e7d15bfd8770d2682c2b953; >= 63de51327a64c74e85611a0161eaae71256a3b6d, < 9b871369cbb4532f6715e044d6b9c4ceb036e5b6; >= 63de51327a64c74e85611a0161eaae71256a3b6d, < 747eaead2db298abfda2aa505f6d03775b40fe5f; >= 63de51327a64c74e85611a0161eaae71256a3b6d, < 2c007acf7b31c39c08ce4959451ad00b19be4c1f
LinuxLinux5.14

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-72082?
In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() When efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error path returns -ENOSPC without releasing the reference obtained via kref_get_unless_zero() earlier in the function. All other error paths correctly drop the reference. This causes a permanent reference leak on the io_to_abort object. Additionally, the abort_in_progress flag is left set to true on this path, which means future abort attempts for the same I/O will immediately return -EINPROGRESS even though the abort was never submitted, effectively blocking recovery. Fix this by adding the missing kref_put() call and reset abort_in_progress to false, matching the cleanup done in the efct_hw_wq_write() failure path below.
How severe is CVE-2026-72082?
Severity scoring for CVE-2026-72082 is pending analysis. The EPSS model estimates a 0.21% probability of exploitation in the next 30 days.
How do I fix CVE-2026-72082?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-72082?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST