CVE-2026-72308

Received Received - Intake

Refcount Leak in Linux Kernel mlxsw Driver

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() When mlxsw_sp_port_lag_index_get() fails, mlxsw_sp_port_lag_join() returns an error without releasing the lag reference obtained by the earlier mlxsw_sp_lag_get(). All other error paths in the function jump to the cleanup label that ends with mlxsw_sp_lag_put(), so this is a single missed release. Fix the leak by replacing the bare 'return err' with a goto to the existing error cleanup label, which will drop the reference safely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72308

EUVD

EUVD-2026-59207

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*
mlxsw	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a reference count is not properly released when a function fails. Specifically, in the mlxsw driver, if mlxsw_sp_port_lag_index_get() fails, mlxsw_sp_port_lag_join() returns an error without releasing a lag reference obtained earlier by mlxsw_sp_lag_get().

Detection Guidance

This vulnerability is specific to the Linux kernel's mlxsw driver and involves a refcount leak in port lag join operations. Detection requires checking for kernel logs or memory leaks related to mlxsw operations. Use commands like dmesg | grep mlxsw or journalctl -k | grep mlxsw to inspect kernel logs for errors or warnings. If the system is affected, you may see messages about refcount leaks or failed lag operations.

Impact Analysis

This vulnerability could lead to a memory leak in the Linux kernel, potentially causing system instability or resource exhaustion over time if exploited repeatedly.

Compliance Impact

This vulnerability is a local kernel memory leak in the Linux kernel's mlxsw driver, which does not directly impact data privacy or security controls required by GDPR or HIPAA. It may indirectly affect compliance by causing system instability or resource exhaustion, but no evidence links it to violations of these standards.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve the refcount leak in mlxsw_sp_port_lag_join().

Hi! I’m here to help you understand CVE-2026-72308. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70