The Linux kernel contains a flaw in the SCSI disk subsystem where a missing put_disk() call leaves a gendisk structure referenced after device_add(&disk_dev) fails. This creates a memory leak or dangling reference that can cause resource exhaustion or system instability if repeated over time. The vulnerability is a kernel‑level bug that can lead to denial of service by corrupting internal disk management structures.

All Linux kernel releases are affected because the issue is present in the core SCSI disk driver. No specific kernel version range is provided, so administrators should treat every kernel prior to the commit that added the missing put_disk() as vulnerable.

The exploit requires interaction with the kernel during device addition, which is normally a privileged operation performed by the system when a SCSI disk is accessed or inserted. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not provided. However, because the flaw is local to kernel operations and can lead to resource exhaustion, the overall risk is moderate; an attacker with local privileged access could repeatedly trigger the error path to deplete memory or crash the system.