A reference count leak in the Linux kernel’s SCSI core occurs when a SCSI host is torn down, leading to a hang in processes such as iscsid. The vulnerability is a form of resource exhaustion (CWE‑911) that can disrupt services that depend on SCSI device management, effectively causing a denial of service rather than exposing data or code execution.

All Linux kernel implementations are affected; vendor or distribution information is not tied to a specific released version in the advisory. The issue resides at the kernel level, so any distribution that includes the vulnerable kernel code is impacted.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a very low probability of observed exploitation. The vulnerability is not listed in CISA’s KEV catalog and no public exploit has been reported. Exploitation would likely require an attacker to trigger SCSI host teardown—an action that typically requires local system interaction or a scenario such as disabling SCSI services—which is inferred from the provided trace rather than explicitly documented.