The Linux kernel SCSI ELX driver contains a bug in efct_hw_io_abort(), where an error path that fails in efct_hw_reqtag_alloc() leaves a reference obtained by kref_get_unless_zero() unreleased. This permanent refcount leak can accumulate and exhaust kernel resources. The abort_in_progress flag is also left set to true, causing subsequent abort attempts for the same I/O to return -EINPROGRESS even though the abort was never submitted, effectively preventing recovery. The flaw is a resource leak and state inconsistency that can degrade device availability and ultimately lead to denial of service.

All Linux kernel releases that include the legacy ELX SCSI driver before the commit that implements this fix are affected. The vulnerability applies to the generic Linux kernel package according to its CPE. Systems running unpatched kernel images that expose the SCSI ELX subsystem—typically those that interact with the hardware controller for which the driver is built—may experience the refcount leak and blocked aborts.

The EPSS score of 0.00215 (<1%) indicates a low probability of exploitation, but the vulnerability is not listed in CISA KEV and no publicly known exploits are documented. The CVSS base score of 5.5 indicates a moderate severity assessment. The error occurs within the kernel’s SCSI subsystem and requires manipulation of the device I/O to trigger the bug, so the need for local or privileged access is inferred from this fact. Attackers would need to be able to invoke the offending abort path, likely through root privileges or a process with elevated SCSI access. While the risk is not remote at present, the accumulation of leaked references and persistent abort_in_progress flags can lead to a local denial of service that disables further I/O operations on the affected device.