mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.22 % · percentile 13 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() When mlxsw_sp_port_lag_index_get() fails, mlxsw_sp_port_lag_join() returns an error without releasing the lag reference obtained by the earlier mlxsw_sp_lag_get(). All other error paths in the function jump to the cleanup label that ends with mlxsw_sp_lag_put(), so this is a single missed release. Fix the leak by replacing the bare 'return err' with a goto to the existing error cleanup label, which will drop the reference safely.
References
- https://git.kernel.org/stable/c/3fbeaa8ecd144ad593f9fa1ab4b40a780ad3700b
- https://git.kernel.org/stable/c/99ff5b0083eae6f774360c4ea6874604e6c9b553
- https://git.kernel.org/stable/c/9bf2d6eea26a226f8ebab7baea6f2b018f914560
- https://git.kernel.org/stable/c/8b3350eacd9df0597bfe36a594df7b9def0b3edf
- https://git.kernel.org/stable/c/1cf8a1af42b1f12a30b7abd34fe4fc23b3170e7e
- https://git.kernel.org/stable/c/2d8b3c3e129973a51ae924bdcf6993a76b828814
- https://git.kernel.org/stable/c/cab468c3c03f4bcd7530ce2783a4140da14efb7b
- https://git.kernel.org/stable/c/41c8c1d65b32beacd8d916a22457b4f6e47f45af
European references
- ENISA EUVD · EUVD-2026-59207
- GCVE · GCVE-0-2026-72308
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1255 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1202 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1164 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1163 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 0d65fc13042fce6a2d6de58ff0dc9531e8523c07 < 3fbeaa8ecd144ad593f9fa1ab4b40a780ad3700b ; affected 0d65fc13042fce6a2d6de58ff0dc9531e8523c07 < 99ff5b0083eae6f774360c4ea6874604e6c9b553 ; affected 0d65fc13042fce6a2d6de58ff0dc9531e8523c07 < 9bf2d6eea26a226f8ebab7baea6f2b018f914560 ; affected 0d65fc13042fce6a2d6de58ff0dc9531e8523c07 < 8b3350eacd9df0597bfe36a594df7b9def0b3edf ; affected 0d65fc13042fce6a2d6de58ff0dc9531e8523c07 < 1cf8a1af42b1f12a30b7abd34fe4fc23b3170e7e ; affected 0d65fc13042fce6a2d6de58ff0dc9531e8523c07 < 2d8b3c3e129973a51ae924bdcf6993a76b828814 |
| Linux · Linux | affected 4.5 ; unaffected 0 < 4.5 ; unaffected 5.10.266 ≤ 5.10.* ; unaffected 5.15.217 ≤ 5.15.* ; unaffected 6.1.184 ≤ 6.1.* ; unaffected 6.6.145 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |