CVE-2026-64376

Awaiting Analysis Awaiting Analysis - Queue

Linux kernel firmware loader reference leak fix

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: firmware_loader: fix device reference leak in firmware_upload_register() firmware_upload_register() -> fw_create_instance() -> device_initialize() After fw_create_instance() succeeds, the lifetime of the embedded struct device is expected to be managed through the device core reference counting, since fw_create_instance() has already called device_initialize(). In firmware_upload_register(), if alloc_lookup_fw_priv() fails after fw_create_instance() succeeds, the code reaches free_fw_sysfs and frees fw_sysfs directly instead of releasing the device reference with put_device(). This may leave the reference count of the embedded struct device unbalanced, resulting in a refcount leak. The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix this by using put_device(fw_dev) in the failure path and letting fw_dev_release() handle the final cleanup, instead of freeing the instance directly from the error path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64376

EUVD

EUVD-2026-48920

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a reference count leak in the Linux kernel's firmware loader subsystem. When registering a firmware upload, if an allocation fails after initializing a device structure, the code incorrectly frees the device directly instead of releasing its reference count. This leaves the device reference unbalanced, causing a memory leak where the device's reference count never reaches zero.

Detection Guidance

This vulnerability is specific to the Linux kernel's firmware loader subsystem and does not have direct network detection methods. Detection requires checking the kernel version and verifying if the vulnerable code path exists in the running kernel. Use uname -a to check the kernel version and examine kernel logs for firmware-related errors.

Impact Analysis

This vulnerability primarily affects system stability and resource usage. It may cause gradual depletion of available memory and device slots over time as leaked references accumulate. In severe cases, this could lead to system crashes or denial of service due to exhausted kernel resources.

Compliance Impact

This vulnerability is a reference count leak in the Linux kernel's firmware loader subsystem. It does not directly affect compliance with standards like GDPR or HIPAA, as it is a low-level memory management issue rather than a data protection or privacy breach.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to ensure the patched firmware loader code is in place. If an update is not immediately available, consider recompiling the kernel with the fix or disabling vulnerable firmware upload features if not required.

Hi! I’m here to help you understand CVE-2026-64376. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70