GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-72082

Vulnerability from fkie_nvd - Published: 2026-08-15 06:21 - Updated: 2026-08-17 06:18
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() When efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error path returns -ENOSPC without releasing the reference obtained via kref_get_unless_zero() earlier in the function. All other error paths correctly drop the reference. This causes a permanent reference leak on the io_to_abort object. Additionally, the abort_in_progress flag is left set to true on this path, which means future abort attempts for the same I/O will immediately return -EINPROGRESS even though the abort was never submitted, effectively blocking recovery. Fix this by adding the missing kref_put() call and reset abort_in_progress to false, matching the cleanup done in the efct_hw_wq_write() failure path below.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1c6e186c722cfa9a58ebe841f91ab2ddf8570cc7
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2c007acf7b31c39c08ce4959451ad00b19be4c1f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/62cf39a9770a6f29df59fd0edb0a05234a8b07f2
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/747eaead2db298abfda2aa505f6d03775b40fe5f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9b871369cbb4532f6715e044d6b9c4ceb036e5b6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cf97ea7b164a1881c7219f5222219c9d0fac4204
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/faa59add4808fbf92e7d15bfd8770d2682c2b953
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/elx/efct/efct_hw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cf97ea7b164a1881c7219f5222219c9d0fac4204",
              "status": "affected",
              "version": "63de51327a64c74e85611a0161eaae71256a3b6d",
              "versionType": "git"
            },
            {
              "lessThan": "1c6e186c722cfa9a58ebe841f91ab2ddf8570cc7",
              "status": "affected",
              "version": "63de51327a64c74e85611a0161eaae71256a3b6d",
              "versionType": "git"
            },
            {
              "lessThan": "62cf39a9770a6f29df59fd0edb0a05234a8b07f2",
              "status": "affected",
              "version": "63de51327a64c74e85611a0161eaae71256a3b6d",
              "versionType": "git"
            },
            {
              "lessThan": "faa59add4808fbf92e7d15bfd8770d2682c2b953",
              "status": "affected",
              "version": "63de51327a64c74e85611a0161eaae71256a3b6d",
              "versionType": "git"
            },
            {
              "lessThan": "9b871369cbb4532f6715e044d6b9c4ceb036e5b6",
              "status": "affected",
              "version": "63de51327a64c74e85611a0161eaae71256a3b6d",
              "versionType": "git"
            },
            {
              "lessThan": "747eaead2db298abfda2aa505f6d03775b40fe5f",
              "status": "affected",
              "version": "63de51327a64c74e85611a0161eaae71256a3b6d",
              "versionType": "git"
            },
            {
              "lessThan": "2c007acf7b31c39c08ce4959451ad00b19be4c1f",
              "status": "affected",
              "version": "63de51327a64c74e85611a0161eaae71256a3b6d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/elx/efct/efct_hw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: elx: efct: Fix refcount leak in efct_hw_io_abort()\n\nWhen efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error path\nreturns -ENOSPC without releasing the reference obtained via\nkref_get_unless_zero() earlier in the function. All other error paths\ncorrectly drop the reference. This causes a permanent reference leak on the\nio_to_abort object.\n\nAdditionally, the abort_in_progress flag is left set to true on this path,\nwhich means future abort attempts for the same I/O will immediately return\n-EINPROGRESS even though the abort was never submitted, effectively\nblocking recovery.\n\nFix this by adding the missing kref_put() call and reset abort_in_progress\nto false, matching the cleanup done in the efct_hw_wq_write() failure path\nbelow."
    }
  ],
  "id": "CVE-2026-72082",
  "lastModified": "2026-08-17T06:18:06.940",
  "metrics": {},
  "published": "2026-08-15T06:21:18.250",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1c6e186c722cfa9a58ebe841f91ab2ddf8570cc7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2c007acf7b31c39c08ce4959451ad00b19be4c1f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/62cf39a9770a6f29df59fd0edb0a05234a8b07f2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/747eaead2db298abfda2aa505f6d03775b40fe5f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9b871369cbb4532f6715e044d6b9c4ceb036e5b6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cf97ea7b164a1881c7219f5222219c9d0fac4204"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/faa59add4808fbf92e7d15bfd8770d2682c2b953"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.