The vulnerability in the Linux kernel's nvmet-fc subsystem involved improper handling of asynchronous commands in __nvmet_fc_send_ls_req. Multiple commands could be active concurrently, each incrementing a tgtport reference. However, the code only queued a single put work item, leading to leaked references and potential resource exhaustion or denial of service. The patch moves the put work item into the nvmet_fc_ls_req_op struct, which manages all command-related resources, preventing the leak.

This vulnerability results in a resource leak due to unreleased tgtport references when multiple asynchronous commands are processed concurrently. The impact is denial of service (availability) degradation, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). There is no confidentiality or integrity impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a Linux kernel vulnerability, monitor official Linux kernel releases and security advisories for the availability of an official fix. Apply the patch once available to prevent resource leaks and potential denial of service.