CVE-2026-68333
Received Received - Intake

Memory Leak in Linux Kernel dpaa2-switch Driver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: put MAC endpoint device on disconnect fsl_mc_get_endpoint() returns the MAC endpoint device with a reference taken through device_find_child(). The switch port connect path stores that device in mac->mc_dev and keeps it for the lifetime of the connected MAC object. However, the disconnect path only closes the MAC and frees the dpaa2_mac object. It does not drop the endpoint device reference stored in mac->mc_dev, so every successful connect leaks that device reference when the MAC is later disconnected. Drop the endpoint device reference before freeing the dpaa2_mac object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68333
EUVD
EUVD-2026-55434

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the dpaa2-switch driver. When a MAC endpoint device is connected, a reference is taken but not properly released during disconnection. This causes the endpoint device reference to leak every time the MAC is disconnected, potentially leading to resource exhaustion over time.

Detection Guidance

This vulnerability is specific to the Linux kernel's dpaa2-switch driver and does not have a direct network detection method. It can only be detected by checking the kernel version and verifying if the vulnerable code path exists in the running kernel. Use commands like 'uname -a' to check the kernel version and 'lsmod | grep dpaa2' to see if the driver is loaded.

Impact Analysis

The impact includes system instability due to resource leaks, potential crashes from running out of available device references, and degraded performance as memory or device handles are exhausted. Systems using the dpaa2-switch driver are most affected.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to ensure the vulnerability is patched. If an update is not available, consider recompiling the kernel with the fix or disabling the dpaa2-switch driver if not in use.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68333. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart