This vulnerability occurs in the Linux kernel when a task‑management request (TMR) submission fails during a pvSCSI guest operation. The code path incorrectly frees the command tag associated with the request, leaving the tag leaked and causing the command to never be released. The guest can trigger this failure by issuing VSCSIIF_ACT_SCSI_ABORT or RESET commands. As a result, the host LUN session can stall and become unusable, effectively denying service to the affected storage target.

The flaw resides in the generic Linux kernel, affecting all distributions that use the default kernel without the patch. No specific version range is documented in the CNA data, implying that any kernel applying the upstream fix is relevant. The vulnerability manifests in virtualized environments that employ pvSCSI backends. Based on the description, it is inferred that any host running a virtualized guest with a pvSCSI target could be impacted.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of <1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attacker would need control of a pvSCSI guest and the ability to intentionally cause TMR submission to fail, a feasible scenario inside a virtual machine. If successfully exploited, the denial of service of the target LUN could be achieved, and the double‑free path might lead to memory corruption if the attacker can manipulate subsequent memory usage.