The tcm_loop_target_reset routine in the Linux kernel was implemented incorrectly: when it returned SUCCESS it did not drain or complete in‑flight SCSI commands. This allowed the target core to recycle scsi_cmnd structures for recovery commands while still holding references to commands that were not yet fully finished. The result was a leaked LUN reference that prevented transport_clear_lun_ref from succeeding, leading to a long‑blocked task in D state and a frozen configfs LUN unlink, effectively a denial of service on the SCSI target subsystem.

All Linux kernels that include the target_core tcm_loop module are affected, regardless of distribution. The fix was introduced in recent kernel commits and thus any kernel version prior to those commits is vulnerable.

The vulnerability carries a CVSS score of 5.5, indicating moderate severity, yet its EPSS score is below 1%, demonstrating a low probability of exploitation. It is not listed in CISA’s KEV catalog and no publicly documented exploit has been reported. The bug requires a target reset operation, so the likely attack vector is local and privileged; an attacker who can trigger a reset could cause a kernel hang, resulting in a denial‑of‑service condition that necessitates patching.