In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices… (CVE-2026-99019)

The Linux kernel's SCSI changer driver (ch) maintained references to scsi_device objects for data transfer element devices reported by the changer. The function ch_readconfig() stored these references in an array (ch->dt[]), but never released them, causing a reference leak. When a device was removed, its scsi_device remained on the host's device list, blocking new devices at the same address and preventing module unloads. The fix drops the reference as soon as the device name is printed and removes the unused dt[] array, eliminating the leak. This vulnerability was observed with virtual libraries such as mhvtl and was previously reported but not merged until now.

The vulnerability causes resource leaks in the kernel by retaining references to removed SCSI devices, which prevents the unloading of the affected kernel module and blocks new devices from being recognized at the same address. This can lead to system instability and requires a reboot to recover. No active exploits are known.

A fix has been applied in the Linux kernel to drop the references immediately after use and remove the unused array causing the leak. Users should update to the fixed kernel version once available. No additional mitigation is required beyond applying the official patch.