From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-72308: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
Date: Sat, 15 Aug 2026 15:06:27 +0900 [thread overview]
Message-ID: <2026081504-CVE-2026-72308-c2fb@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
mlxsw: fix refcount leak in mlxsw_sp_port_lag_join()
When mlxsw_sp_port_lag_index_get() fails, mlxsw_sp_port_lag_join()
returns an error without releasing the lag reference obtained by
the earlier mlxsw_sp_lag_get(). All other error paths in the
function jump to the cleanup label that ends with
mlxsw_sp_lag_put(), so this is a single missed release.
Fix the leak by replacing the bare 'return err' with a goto to the
existing error cleanup label, which will drop the reference safely.
The Linux kernel CVE team has assigned CVE-2026-72308 to this issue.
Affected and fixed versions
===========================
Issue introduced in 4.5 with commit 0d65fc13042fce6a2d6de58ff0dc9531e8523c07 and fixed in 6.6.145 with commit 8b3350eacd9df0597bfe36a594df7b9def0b3edf
Issue introduced in 4.5 with commit 0d65fc13042fce6a2d6de58ff0dc9531e8523c07 and fixed in 6.12.97 with commit 1cf8a1af42b1f12a30b7abd34fe4fc23b3170e7e
Issue introduced in 4.5 with commit 0d65fc13042fce6a2d6de58ff0dc9531e8523c07 and fixed in 6.18.40 with commit 2d8b3c3e129973a51ae924bdcf6993a76b828814
Issue introduced in 4.5 with commit 0d65fc13042fce6a2d6de58ff0dc9531e8523c07 and fixed in 7.1.5 with commit cab468c3c03f4bcd7530ce2783a4140da14efb7b
Issue introduced in 4.5 with commit 0d65fc13042fce6a2d6de58ff0dc9531e8523c07 and fixed in 7.2-rc1 with commit 41c8c1d65b32beacd8d916a22457b4f6e47f45af
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-72308
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/net/ethernet/mellanox/mlxsw/spectrum.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/8b3350eacd9df0597bfe36a594df7b9def0b3edf
https://git.kernel.org/stable/c/1cf8a1af42b1f12a30b7abd34fe4fc23b3170e7e
https://git.kernel.org/stable/c/2d8b3c3e129973a51ae924bdcf6993a76b828814
https://git.kernel.org/stable/c/cab468c3c03f4bcd7530ce2783a4140da14efb7b
https://git.kernel.org/stable/c/41c8c1d65b32beacd8d916a22457b4f6e47f45af
reply other threads:[~2026-08-15 6:21 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026081504-CVE-2026-72308-c2fb@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.