CVE-2026-68331
dpaa2-eth: put MAC endpoint device on disconnect
En bref
- Source
- NVD
- EPSS
- EPSS 0.17 % · centile 7 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: dpaa2-eth: put MAC endpoint device on disconnect fsl_mc_get_endpoint() returns the MAC endpoint device with a reference taken through device_find_child(). The Ethernet connect path stores that device in mac->mc_dev and keeps it for the lifetime of the connected MAC object. However, the disconnect path only disconnects and closes the MAC before freeing the dpaa2_mac object. It does not drop the endpoint device reference stored in mac->mc_dev, so every successful connect leaks that device reference when the MAC is later disconnected. Drop the endpoint device reference after closing the MAC and before freeing the dpaa2_mac object.
Références
- https://git.kernel.org/stable/c/6b6ffdb9ca4547a3c4c274aa3e25b6c68dbc62e1
- https://git.kernel.org/stable/c/1974127776da46a000c61f36d4946799ea6d4f51
- https://git.kernel.org/stable/c/915012e923316b8b5d5bf8fc771617b47bd7572d
- https://git.kernel.org/stable/c/e23e4a3b9dfd893469c731318d409cdf04fb1ddf
- https://git.kernel.org/stable/c/f112df0744e2d77baa68eeebb860021bbaaa022a
- https://git.kernel.org/stable/c/a3cecf169cc652b558d08661bb6ce55e4c933ec0
- https://git.kernel.org/stable/c/b4b201cc93ff70150853aba03e14d314d1980ca0
Références européennes
- ENISA EUVD · EUVD-2026-55432
- GCVE · GCVE-0-2026-68331
Avis du CERT-FR
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1255 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1202 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1164 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1163 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1069 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 71947923089353f23f4f210864903c4dcf2c1696 < 6b6ffdb9ca4547a3c4c274aa3e25b6c68dbc62e1 ; affected 71947923089353f23f4f210864903c4dcf2c1696 < 1974127776da46a000c61f36d4946799ea6d4f51 ; affected 71947923089353f23f4f210864903c4dcf2c1696 < 915012e923316b8b5d5bf8fc771617b47bd7572d ; affected 71947923089353f23f4f210864903c4dcf2c1696 < e23e4a3b9dfd893469c731318d409cdf04fb1ddf ; affected 71947923089353f23f4f210864903c4dcf2c1696 < f112df0744e2d77baa68eeebb860021bbaaa022a ; affected 71947923089353f23f4f210864903c4dcf2c1696 < a3cecf169cc652b558d08661bb6ce55e4c933ec0 |
| Linux · Linux | affected 5.5 ; unaffected 0 < 5.5 ; unaffected 5.15.216 ≤ 5.15.* ; unaffected 6.1.183 ≤ 6.1.* ; unaffected 6.6.148 ≤ 6.6.* ; unaffected 6.12.101 ≤ 6.12.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |