CVE-2026-72082 scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
A reference leak in the Linux kernel's efct driver can cause permanent resource exhaustion and block I/O recovery, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72082?
CVE-2026-72082 is a denial of service vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
When efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error path returns -ENOSPC without releasing the reference obtained via kref_get_unless_zero() earlier in the function. All other error paths correctly drop the reference. This causes a permanent reference leak on the io_to_abort object.
Additionally, the abort_in_progress flag is left set to true on this path, which means future abort attempts for the same I/O will immediately return -EINPROGRESS even though the abort was never submitted, effectively blocking recovery.
Fix this by adding the missing kref_put() call and reset abort_in_progress to false, matching the cleanup done in the efct_hw_wq_write() failure path below.
Which versions are affected by CVE-2026-72082?
How do I fix CVE-2026-72082?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-72082 being exploited?
There is no known exploitation of CVE-2026-72082 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72082, DEBIAN-CVE-2026-72082, GHSA-mfvg-9fxc-6x5q, UBUNTU-CVE-2026-72082.