CVE-2026-72082

Not scored yetLast modified Aug 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()

When efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error path returns -ENOSPC without releasing the reference obtained via kref_get_unless_zero() earlier in the function. All other error paths correctly drop the reference. This causes a permanent reference leak on the io_to_abort object.

Additionally, the abort_in_progress flag is left set to true on this path, which means future abort attempts for the same I/O will immediately return -EINPROGRESS even though the abort was never submitted, effectively blocking recovery.

Fix this by adding the missing kref_put() call and reset abort_in_progress to false, matching the cleanup done in the efct_hw_wq_write() failure path below.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 63de51327a64c74e85611a0161eaae71256a3b6d, < cf97ea7b164a1881c7219f5222219c9d0fac4204; >= 63de51327a64c74e85611a0161eaae71256a3b6d, < 1c6e186c722cfa9a58ebe841f91ab2ddf8570cc7; >= 63de51327a64c74e85611a0161eaae71256a3b6d, < 62cf39a9770a6f29df59fd0edb0a05234a8b07f2; >= 63de51327a64c74e85611a0161eaae71256a3b6d, < faa59add4808fbf92e7d15bfd8770d2682c2b953; >= 63de51327a64c74e85611a0161eaae71256a3b6d, < 9b871369cbb4532f6715e044d6b9c4ceb036e5b6; >= 63de51327a64c74e85611a0161eaae71256a3b6d, < 747eaead2db298abfda2aa505f6d03775b40fe5f; >= 63de51327a64c74e85611a0161eaae71256a3b6d, < 2c007acf7b31c39c08ce4959451ad00b19be4c1f
LinuxLinux5.14

References

Timeline

Published
Aug 15, 2026
Last modified
Aug 17, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-720839.8In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE CVE-2026-720849.8In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer CVE-2026-720859.3In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free unsubmitted command instead of double-puttingCVE-2026-72086In the Linux kernel, the following vulnerability has been resolved: scsi: xen: scsiback: Free the command tag on the TMR submit-failure patCVE-2026-72087In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() The mCVE-2026-72088In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path If phys_disk->CVE-2026-720897.1In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Reject firmware log with size smaller than header fw_log_fCVE-2026-72096.4The Simple Link Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `qcopd-directory` shortcode in CVE-2026-720907.8In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Use caller client for debug BO sync amdxdna_drm_sync_boCVE-2026-72091In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject user command submission without a command BO amdCVE-2026-72092In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject command submission on devices without a submit opCVE-2026-720937.8In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap() When vm
CVE-2026-72082: Unscored | Vulnix