A flaw in the Linux kernel SCSI changer subsystem causes an unreleased reference to a scsi_device to persist after a drive is removed. The ch_readconfig() routine stores a scsi_device lookup result for each element reported in the READ ELEMENT STATUS command but never drops the reference. The stale reference remains in the host device list, preventing new devices from being added and blocking the driver from unloading. Repeated add/remove cycles leave more references, increasing the module’s use count until it can no longer be unloaded. The problem can be triggered by any SCSI changer that reports element IDs and requires privileged access to manipulate the changer. It results only in local denial of service; a reboot restores functionality.

All Linux kernel versions that include the SCSI changer subsystem and support element status reporting are potentially affected. The issue was reproduced with an IBM 3573‑TL mhvtl virtual library, but any changer reporting drive IDs can trigger the leak. No specific version constraints are listed, so all kernels with this functionality are at risk.

The CVSS score is 2.3 and the EPSS score is less than 1%, indicating a low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers must have privileged access to removal and insertion of drives on the changer; once the reference leak is triggered, the system’s ability to unload the low-level driver is permanently impaired until a reboot. The impact is local, affecting only the host’s ability to manage the device, but repeated exploitation can lead to a subtle denial of service for device operations.