{"cve":"CVE-2026-72082","nvd":{"published":"2026-08-15T06:21:18.250","modified":"2026-08-17T06:18:06.940","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: elx: efct: Fix refcount leak in efct_hw_io_abort()\n\nWhen efct_hw_reqtag_alloc() fails in efct_hw_io_abort(), the error path\nreturns -ENOSPC without releasing the reference obtained via\nkref_get_unless_zero() earlier in the function. All other error paths\ncorrectly drop the reference. This causes a permanent reference leak on the\nio_to_abort object.\n\nAdditionally, the abort_in_progress flag is left set to true on this path,\nwhich means future abort attempts for the same I/O will immediately return\n-EINPROGRESS even though the abort was never submitted, effectively\nblocking recovery.\n\nFix this by adding the missing kref_put() call and reset abort_in_progress\nto false, matching the cleanup done in the efct_hw_wq_write() failure path\nbelow.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/1c6e186c722cfa9a58ebe841f91ab2ddf8570cc7","https://git.kernel.org/stable/c/2c007acf7b31c39c08ce4959451ad00b19be4c1f","https://git.kernel.org/stable/c/62cf39a9770a6f29df59fd0edb0a05234a8b07f2","https://git.kernel.org/stable/c/747eaead2db298abfda2aa505f6d03775b40fe5f","https://git.kernel.org/stable/c/9b871369cbb4532f6715e044d6b9c4ceb036e5b6"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:48:17.459049833+00:00"},"epss":{"cve":"CVE-2026-72082","score":0.00215,"percentile":0.11867,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}