mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
Summary
| CVE | CVE-2026-72307 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-15 06:22:03 UTC |
| Updated | 2026-08-15 06:22:03 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() When mlxsw_sp_vrs_lpm_tree_replace() fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but fails to update the vr pointer, which still points to the VR that caused the failure. As a result, the condition and the rollback call always operate on the same VR, potentially calling mlxsw_sp_vr_lpm_tree_replace() multiple times on it while never rolling back the earlier VRs. Those VRs continue to hold a reference to new_tree acquired via mlxsw_sp_lpm_tree_hold(), leaking the reference count of new_tree. Fix by reinitializing vr inside the error loop with the updated index: vr = &mlxsw_sp->router->vrs[i]; so that the loop correctly iterates over all VRs that were actually replaced. |
Risk And Classification
EPSS: 0.002200000 probability, percentile 0.127520000 (date 2026-08-15)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected fc922bb0dd9406dd9897fd47df958789891c380e c2c75c45b54f3b12eafb28a4eb47f8821512c1aa git | Not specified |
| CNA | Linux | Linux | affected fc922bb0dd9406dd9897fd47df958789891c380e 7203ac71d3895fa5948b319dd724f0e1cffbc4a1 git | Not specified |
| CNA | Linux | Linux | affected fc922bb0dd9406dd9897fd47df958789891c380e f6454a5fbf2224ad30ec70e686a6c592561da1f2 git | Not specified |
| CNA | Linux | Linux | affected fc922bb0dd9406dd9897fd47df958789891c380e 220d41bdce41fe5a39a7f419faab1e907b4093c2 git | Not specified |
| CNA | Linux | Linux | affected fc922bb0dd9406dd9897fd47df958789891c380e 9e4a6185679922305ea1df68403f00ccc512656b git | Not specified |
| CNA | Linux | Linux | affected fc922bb0dd9406dd9897fd47df958789891c380e 3a2b47d1b4b3de54d030a7fdb6a322c970513ee3 git | Not specified |
| CNA | Linux | Linux | affected fc922bb0dd9406dd9897fd47df958789891c380e 8adebf07b46df79a0e49a6d4ae384f0db7c91db6 git | Not specified |
| CNA | Linux | Linux | affected fc922bb0dd9406dd9897fd47df958789891c380e 21cf8dc478a49e8de039c2739b1646a774cb1944 git | Not specified |
| CNA | Linux | Linux | affected 4.14 | Not specified |
| CNA | Linux | Linux | unaffected 4.14 semver | Not specified |
| CNA | Linux | Linux | unaffected 5.10.261 5.10.* semver | Not specified |
| CNA | Linux | Linux | unaffected 5.15.212 5.15.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.178 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.145 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.97 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.40 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1.5 7.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2-rc1 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/f6454a5fbf2224ad30ec70e686a6c592561da1f2 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/21cf8dc478a49e8de039c2739b1646a774cb1944 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/220d41bdce41fe5a39a7f419faab1e907b4093c2 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/c2c75c45b54f3b12eafb28a4eb47f8821512c1aa | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/8adebf07b46df79a0e49a6d4ae384f0db7c91db6 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/9e4a6185679922305ea1df68403f00ccc512656b | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/3a2b47d1b4b3de54d030a7fdb6a322c970513ee3 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/7203ac71d3895fa5948b319dd724f0e1cffbc4a1 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.