The Linux kernel’s SCSI subsystem contains a flaw that causes an allocated I/O object to be leaked when an unsolicited FCP command includes an unsupported additional CDB. This results in the kernel performing a memory allocation for an efct_io, then returning an error before the object is freed. Because the reference count never drops, each erroneous command consumes kernel memory until the device is exhausted, potentially causing denial of service.

The vulnerability resides in the Linux kernel, affecting all current releases that implement the elx:efct SCSI driver. No specific vendor or product version is enumerated, but the change applies to every kernel with this driver. Administrators should verify whether their systems run a kernel that includes the driver.

The CVSS score is 5.5, indicating a moderate severity. Given the potential to exhaust memory and disable the device, the risk is moderate. The EPSS score is < 1%, and the flaw is not listed in CISA KEV. Attackers would need local access to trigger the unsupported command path or a malicious SCSI target that forces the kernel to process unsupported additional CDBs. Once triggered, repeated requests could drain memory and bring the system to a halt.