CVE-2026-72082

Source
https://cve.org/CVERecord?id=CVE-2026-72082
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72082.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-72082
Downstream
Published
2026-08-15T05:52:31.291Z
Modified
2026-08-16T03:48:31.771605467Z
Summary
scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
Details

In the Linux kernel, the following vulnerability has been resolved:

scsi: elx: efct: Fix refcount leak in efcthwio_abort()

When efcthwreqtagalloc() fails in efcthwioabort(), the error path returns -ENOSPC without releasing the reference obtained via krefgetunlesszero() earlier in the function. All other error paths correctly drop the reference. This causes a permanent reference leak on the ioto_abort object.

Additionally, the abortinprogress flag is left set to true on this path, which means future abort attempts for the same I/O will immediately return -EINPROGRESS even though the abort was never submitted, effectively blocking recovery.

Fix this by adding the missing krefput() call and reset abortinprogress to false, matching the cleanup done in the efcthwwqwrite() failure path below.

Database specific
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72082.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
63de51327a64c74e85611a0161eaae71256a3b6d
Fixed
cf97ea7b164a1881c7219f5222219c9d0fac4204
Fixed
1c6e186c722cfa9a58ebe841f91ab2ddf8570cc7
Fixed
62cf39a9770a6f29df59fd0edb0a05234a8b07f2
Fixed
faa59add4808fbf92e7d15bfd8770d2682c2b953
Fixed
9b871369cbb4532f6715e044d6b9c4ceb036e5b6
Fixed
747eaead2db298abfda2aa505f6d03775b40fe5f
Fixed
2c007acf7b31c39c08ce4959451ad00b19be4c1f

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72082.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.14.0
Fixed
5.15.212
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.178
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.145
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.97
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.40
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.5

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72082.json"