CVE-2026-72022
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llc_ui_autobind() llc_ui_autobind() opens a SAP after choosing a dynamic LSAP. llc_sap_open() returns a reference owned by the caller, and llc_sap_add_socket() takes a second reference for the socket's membership in the SAP hash tables. llc_ui_bind() drops the caller's reference after adding the socket, but llc_ui_autobind() keeps it. When the socket is closed, llc_sap_remove_socket() releases only the socket reference, leaving the SAP on llc_sap_list with sk_count == 0. This is user-visible because repeated autobind and close cycles can consume all dynamic SAP values and make later autobinds fail with -EUSERS. Drop the caller's reference after a successful autobind, matching llc_ui_bind()'s ownership model.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72022
EUVD
EUVD-2026-58980

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where llc_ui_autobind() fails to release a reference to a SAP (Service Access Point) after binding. This causes the SAP to remain in memory with a zero socket count, eventually exhausting all dynamic SAP values and preventing future autobinds.

Detection Guidance

This vulnerability is specific to the Linux kernel's LLC (Logical Link Control) module and may not have direct network detection methods. Monitor for failed autobind operations returning -EUSERS or check kernel logs for repeated SAP allocation failures. Use commands like dmesg | grep -i llc or journalctl -k | grep -i llc to inspect kernel logs for LLC-related errors.

Impact Analysis

Repeatedly triggering this flaw could lead to denial of service by exhausting available SAP resources, causing new autobind operations to fail with an error. This may disrupt network services relying on LLC (Logical Link Control) functionality.

Mitigation Strategies

Apply the latest Linux kernel updates to patch this vulnerability. Restart affected systems to load the updated kernel. If immediate patching is not possible, restrict untrusted users from creating LLC sockets or monitor SAP resource usage to prevent exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72022. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart