CVE-2026-68331

Received Received - Intake

Memory Leak in Linux Kernel dpaa2-eth Driver

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dpaa2-eth: put MAC endpoint device on disconnect fsl_mc_get_endpoint() returns the MAC endpoint device with a reference taken through device_find_child(). The Ethernet connect path stores that device in mac->mc_dev and keeps it for the lifetime of the connected MAC object. However, the disconnect path only disconnects and closes the MAC before freeing the dpaa2_mac object. It does not drop the endpoint device reference stored in mac->mc_dev, so every successful connect leaks that device reference when the MAC is later disconnected. Drop the endpoint device reference after closing the MAC and before freeing the dpaa2_mac object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68331

EUVD

EUVD-2026-55432

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the dpaa2-eth driver. When a MAC endpoint device is connected, a reference is taken but not properly released during disconnection, causing a resource leak every time the MAC is disconnected.

Detection Guidance

This vulnerability is specific to the Linux kernel's dpaa2-eth driver and may not have direct detection commands. Check kernel logs for errors related to dpaa2-eth or MAC endpoint device issues using: dmesg | grep dpaa2-eth or journalctl -k | grep dpaa2-eth.

Impact Analysis

The impact is primarily on system stability and resource usage. Over time, repeated connections and disconnections of the MAC device could lead to gradual depletion of system resources, potentially causing performance degradation or unexpected behavior.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a memory leak in the Linux kernel's dpaa2-eth driver. Compliance impacts would only occur if the leak led to system instability or data exposure, which is not indicated in the provided context.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. Monitor kernel updates from your distribution and apply them promptly to ensure the vulnerability is addressed.

Hi! I’m here to help you understand CVE-2026-68331. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70