The Linux kernel’s mpi3mr SCSI controller driver suffered a reference count leak that prevented target device structures from ever being freed. The bug arose when an error path skipped the proper release of the target device reference, causing the device to remain allocated indefinitely. This flaw can gradually consume kernel memory and result in a denial of service when the memory pressure propagates to other kernel components. The weakness corresponds to a missing release of resource, specifically a reference count leak.

All Linux kernel builds that include the mpi3mr driver without the referenced fix are affected. The defect was addressed in the kernel commits cited in the official references, so any kernel version released before those commits may still contain the vulnerability.

The vulnerability does not expose remote code execution; it requires the ability to trigger operations that create SCSI target devices, typically requiring kernel module load or privileged access. No EPSS score is available and the issue is not listed in the CISA KEV catalog, indicating that known exploits are not widely documented. Nevertheless, an attacker who can repeatedly initiate the flawed operation could exhaust kernel memory, leading to a local denial‑of‑service condition. The risk is moderate, primarily to availability, and the exploitability is contingent on privileged interaction with the SCSI subsystem.