Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-72022
Published: August 16, 2026
Vulnerability identifier: #VU143566
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72022
CWE-ID: CWE-772
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a reference count leak in llc_ui_autobind() when repeatedly autobinding and closing LLC sockets. A local user can perform repeated autobind and close cycles to cause a denial of service.
The issue can consume all dynamic SAP values, causing subsequent autobind operations to fail with -EUSERS.
Affected software
Linux kernel
How to mitigate CVE-2026-72022
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/21a537606fe35be2b85971a5fd35c0023b6ef98f
- https://git.kernel.org/stable/c/61a7ff4a62003b55a15022567486741b3bd83914
- https://git.kernel.org/stable/c/660667cd406648bbaffbd5c0d897c2263a852f11
- https://git.kernel.org/stable/c/79dc4b508e3f2649390a1f745f7657813e5938ec
- https://git.kernel.org/stable/c/a2f9fa31ae021ef1fdcaf3ab17bd49f9223dd6a4
- https://git.kernel.org/stable/c/b2fc9955ddc7c4ca03be44b995193bd6486c62e1
- https://git.kernel.org/stable/c/b589a965184dde49c43b8caf5bcc65715a7b4ef2
- https://git.kernel.org/stable/c/c7881b6088276601beaccb7440b8d56eab0d65ae