A reference count leak in the Linux kernel’s SCSI core is triggered when a SCSI host is torn down. The leaked counter prevents the host from releasing resources properly, causing processes such as iscsid to hang. This is a resource‑exhaustion flaw (CWE‑911) that results in a denial‑of‑service condition rather than disclosure of data or execution of arbitrary code.

All Linux kernels that contain the vulnerable SCSI core code are affected, including widely used releases such as 6.0 and 7.0. The impact is at the kernel level, so any distribution that ships with the vulnerable code – regardless of vendor – can experience the hang when a SCSI host is removed or when SCSI services are stopped.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% signals an extremely low likelihood of observed exploitation. The vulnerability is not listed in the CISA KEV catalog and no public exploit has been documented. Exploitation would most likely require local or privileged actions that trigger SCSI host teardown – for example, disabling iscsi services or unloading the SCSI host module – as inferred from the tracer’s evidence rather than stated explicitly.