{"api_version":"1","generated_at":"2026-08-16T02:48:32+00:00","cve":"CVE-2026-72307","urls":{"html":"https://cve.report/CVE-2026-72307","api":"https://cve.report/api/cve/CVE-2026-72307.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72307","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72307"},"summary":{"title":"mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()\n\nWhen mlxsw_sp_vrs_lpm_tree_replace() fails after replacing some VRs,\nthe error rollback loop does not correctly revert the preceding\nreplacements. The loop decrements the index but fails to update the\nvr pointer, which still points to the VR that caused the failure. As\na result, the condition and the rollback call always operate on the\nsame VR, potentially calling mlxsw_sp_vr_lpm_tree_replace() multiple\ntimes on it while never rolling back the earlier VRs. Those VRs\ncontinue to hold a reference to new_tree acquired via\nmlxsw_sp_lpm_tree_hold(), leaking the reference count of new_tree.\n\nFix by reinitializing vr inside the error loop with the updated index:\n\n\tvr = &mlxsw_sp->router->vrs[i];\n\nso that the loop correctly iterates over all VRs that were actually\nreplaced.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:22:03","updated_at":"2026-08-15 06:22:03"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/f6454a5fbf2224ad30ec70e686a6c592561da1f2","name":"https://git.kernel.org/stable/c/f6454a5fbf2224ad30ec70e686a6c592561da1f2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/21cf8dc478a49e8de039c2739b1646a774cb1944","name":"https://git.kernel.org/stable/c/21cf8dc478a49e8de039c2739b1646a774cb1944","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/220d41bdce41fe5a39a7f419faab1e907b4093c2","name":"https://git.kernel.org/stable/c/220d41bdce41fe5a39a7f419faab1e907b4093c2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c2c75c45b54f3b12eafb28a4eb47f8821512c1aa","name":"https://git.kernel.org/stable/c/c2c75c45b54f3b12eafb28a4eb47f8821512c1aa","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/8adebf07b46df79a0e49a6d4ae384f0db7c91db6","name":"https://git.kernel.org/stable/c/8adebf07b46df79a0e49a6d4ae384f0db7c91db6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9e4a6185679922305ea1df68403f00ccc512656b","name":"https://git.kernel.org/stable/c/9e4a6185679922305ea1df68403f00ccc512656b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3a2b47d1b4b3de54d030a7fdb6a322c970513ee3","name":"https://git.kernel.org/stable/c/3a2b47d1b4b3de54d030a7fdb6a322c970513ee3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7203ac71d3895fa5948b319dd724f0e1cffbc4a1","name":"https://git.kernel.org/stable/c/7203ac71d3895fa5948b319dd724f0e1cffbc4a1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72307","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72307","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fc922bb0dd9406dd9897fd47df958789891c380e c2c75c45b54f3b12eafb28a4eb47f8821512c1aa git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fc922bb0dd9406dd9897fd47df958789891c380e 7203ac71d3895fa5948b319dd724f0e1cffbc4a1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fc922bb0dd9406dd9897fd47df958789891c380e f6454a5fbf2224ad30ec70e686a6c592561da1f2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fc922bb0dd9406dd9897fd47df958789891c380e 220d41bdce41fe5a39a7f419faab1e907b4093c2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fc922bb0dd9406dd9897fd47df958789891c380e 9e4a6185679922305ea1df68403f00ccc512656b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fc922bb0dd9406dd9897fd47df958789891c380e 3a2b47d1b4b3de54d030a7fdb6a322c970513ee3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fc922bb0dd9406dd9897fd47df958789891c380e 8adebf07b46df79a0e49a6d4ae384f0db7c91db6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fc922bb0dd9406dd9897fd47df958789891c380e 21cf8dc478a49e8de039c2739b1646a774cb1944 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.14","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.14 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.261 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.212 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.178 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.145 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.97 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.40 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72307","cve":"CVE-2026-72307","epss":"0.002200000","percentile":"0.127520000","score_date":"2026-08-15","updated_at":"2026-08-16 00:00:32"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c2c75c45b54f3b12eafb28a4eb47f8821512c1aa","status":"affected","version":"fc922bb0dd9406dd9897fd47df958789891c380e","versionType":"git"},{"lessThan":"7203ac71d3895fa5948b319dd724f0e1cffbc4a1","status":"affected","version":"fc922bb0dd9406dd9897fd47df958789891c380e","versionType":"git"},{"lessThan":"f6454a5fbf2224ad30ec70e686a6c592561da1f2","status":"affected","version":"fc922bb0dd9406dd9897fd47df958789891c380e","versionType":"git"},{"lessThan":"220d41bdce41fe5a39a7f419faab1e907b4093c2","status":"affected","version":"fc922bb0dd9406dd9897fd47df958789891c380e","versionType":"git"},{"lessThan":"9e4a6185679922305ea1df68403f00ccc512656b","status":"affected","version":"fc922bb0dd9406dd9897fd47df958789891c380e","versionType":"git"},{"lessThan":"3a2b47d1b4b3de54d030a7fdb6a322c970513ee3","status":"affected","version":"fc922bb0dd9406dd9897fd47df958789891c380e","versionType":"git"},{"lessThan":"8adebf07b46df79a0e49a6d4ae384f0db7c91db6","status":"affected","version":"fc922bb0dd9406dd9897fd47df958789891c380e","versionType":"git"},{"lessThan":"21cf8dc478a49e8de039c2739b1646a774cb1944","status":"affected","version":"fc922bb0dd9406dd9897fd47df958789891c380e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"4.14"},{"lessThan":"4.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.261","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.212","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.178","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.145","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.97","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.40","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"4.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc1","versionStartIncluding":"4.14","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()\n\nWhen mlxsw_sp_vrs_lpm_tree_replace() fails after replacing some VRs,\nthe error rollback loop does not correctly revert the preceding\nreplacements. The loop decrements the index but fails to update the\nvr pointer, which still points to the VR that caused the failure. As\na result, the condition and the rollback call always operate on the\nsame VR, potentially calling mlxsw_sp_vr_lpm_tree_replace() multiple\ntimes on it while never rolling back the earlier VRs. Those VRs\ncontinue to hold a reference to new_tree acquired via\nmlxsw_sp_lpm_tree_hold(), leaking the reference count of new_tree.\n\nFix by reinitializing vr inside the error loop with the updated index:\n\n\tvr = &mlxsw_sp->router->vrs[i];\n\nso that the loop correctly iterates over all VRs that were actually\nreplaced."}],"providerMetadata":{"dateUpdated":"2026-08-15T05:55:24.622Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/c2c75c45b54f3b12eafb28a4eb47f8821512c1aa"},{"url":"https://git.kernel.org/stable/c/7203ac71d3895fa5948b319dd724f0e1cffbc4a1"},{"url":"https://git.kernel.org/stable/c/f6454a5fbf2224ad30ec70e686a6c592561da1f2"},{"url":"https://git.kernel.org/stable/c/220d41bdce41fe5a39a7f419faab1e907b4093c2"},{"url":"https://git.kernel.org/stable/c/9e4a6185679922305ea1df68403f00ccc512656b"},{"url":"https://git.kernel.org/stable/c/3a2b47d1b4b3de54d030a7fdb6a322c970513ee3"},{"url":"https://git.kernel.org/stable/c/8adebf07b46df79a0e49a6d4ae384f0db7c91db6"},{"url":"https://git.kernel.org/stable/c/21cf8dc478a49e8de039c2739b1646a774cb1944"}],"title":"mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72307","datePublished":"2026-08-15T05:55:24.622Z","dateReserved":"2026-08-09T03:40:39.918Z","dateUpdated":"2026-08-15T05:55:24.622Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:22:03","lastModifiedDate":"2026-08-15 06:22:03","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72307","Ordinal":"1","Title":"mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()","CVE":"CVE-2026-72307","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72307","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nmlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()\n\nWhen mlxsw_sp_vrs_lpm_tree_replace() fails after replacing some VRs,\nthe error rollback loop does not correctly revert the preceding\nreplacements. The loop decrements the index but fails to update the\nvr pointer, which still points to the VR that caused the failure. As\na result, the condition and the rollback call always operate on the\nsame VR, potentially calling mlxsw_sp_vr_lpm_tree_replace() multiple\ntimes on it while never rolling back the earlier VRs. Those VRs\ncontinue to hold a reference to new_tree acquired via\nmlxsw_sp_lpm_tree_hold(), leaking the reference count of new_tree.\n\nFix by reinitializing vr inside the error loop with the updated index:\n\n\tvr = &mlxsw_sp->router->vrs[i];\n\nso that the loop correctly iterates over all VRs that were actually\nreplaced.","Type":"Description","Title":"mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()"}]}}}