CVE-2026-72307
Received Received - Intake

Memory Leak in Linux Kernel mlxsw Driver

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() When mlxsw_sp_vrs_lpm_tree_replace() fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but fails to update the vr pointer, which still points to the VR that caused the failure. As a result, the condition and the rollback call always operate on the same VR, potentially calling mlxsw_sp_vr_lpm_tree_replace() multiple times on it while never rolling back the earlier VRs. Those VRs continue to hold a reference to new_tree acquired via mlxsw_sp_lpm_tree_hold(), leaking the reference count of new_tree. Fix by reinitializing vr inside the error loop with the updated index: vr = &mlxsw_sp->router->vrs[i]; so that the loop correctly iterates over all VRs that were actually replaced.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72307
EUVD
EUVD-2026-59206

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mlxsw linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a refcount leak vulnerability in the Linux kernel's mlxsw driver. It occurs in the function mlxsw_sp_vrs_lpm_tree_replace() when an error happens after replacing some virtual routers (VRs). The error handling loop fails to properly revert changes, causing it to repeatedly operate on the same VR instead of rolling back earlier replacements. This leads to a reference count leak in the LPM tree structure.

Detection Guidance

This vulnerability is specific to the Linux kernel's mlxsw driver and involves a refcount leak in the mlxsw_sp_vrs_lpm_tree_replace() function. Detection requires checking kernel logs for errors related to mlxsw or VRs (Virtual Routers) and verifying if the refcount of LPM trees is not properly decremented. Use commands like dmesg | grep mlxsw or journalctl -k | grep mlxsw to inspect kernel logs for related errors.

Impact Analysis

The vulnerability could cause memory leaks in the Linux kernel when using mlxsw network drivers. This may lead to gradual performance degradation or system instability over time due to unreleased resources. Systems running affected kernel versions with mlxsw hardware may experience crashes or require reboots to recover.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch this vulnerability. If immediate patching is not possible, consider disabling the mlxsw driver if it is not critical for your system. Monitor kernel logs for signs of exploitation or misbehavior related to VRs and LPM trees.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72307. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart