CVE-2026-68331dpaa2-eth: put MAC endpoint device on disconnect
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: dpaa2-eth: put MAC endpoint device on disconnect fsl_mc_get_endpoint() returns the MAC endpoint device with a reference taken through device_find_child(). The Ethernet connect path stores that device in mac->mc_dev and keeps it for the lifetime of the connected MAC object. However, the disconnect path only disconnects and closes the MAC before freeing the dpaa2_mac object. It does not drop the endpoint device reference stored in mac->mc_dev, so every successful connect leaks that device reference when the MAC is later disconnected. Drop the endpoint device reference after closing the MAC and before freeing the dpaa2_mac object.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 71947923089353f23f4f210864903c4dcf2c1696 builds before 6b6ffdb9ca4547a3c4c274aa3e25b6c68dbc62e1; 71947923089353f23f4f210864903c4dcf2c1696 builds before 1974127776da46a000c61f36d4946799ea6d4f51; 71947923089353f23f4f210864903c4dcf2c1696 builds before 915012e923316b8b5d5bf8fc771617b47bd7572d; from 71947923089353f23f4f210864903c4dcf2c1696 before e23e4a3b9dfd893469c731318d409cdf04fb1ddf; from 71947923089353f23f4f210864903c4dcf2c1696 before f112df0744e2d77baa68eeebb860021bbaaa022a; from 71947923089353f23f4f210864903c4dcf2c1696 before a3cecf169cc652b558d08661bb6ce55e4c933ec0; from 71947923089353f23f4f210864903c4dcf2c1696 before b4b201cc93ff70150853aba03e14d314d1980ca0 | CNA record |
References
- https://git.kernel.org/stable/c/6b6ffdb9ca4547a3c4c274aa3e25b6c68dbc62e1
- https://git.kernel.org/stable/c/1974127776da46a000c61f36d4946799ea6d4f51
- https://git.kernel.org/stable/c/915012e923316b8b5d5bf8fc771617b47bd7572d
- https://git.kernel.org/stable/c/e23e4a3b9dfd893469c731318d409cdf04fb1ddf
- https://git.kernel.org/stable/c/f112df0744e2d77baa68eeebb860021bbaaa022a
- https://git.kernel.org/stable/c/a3cecf169cc652b558d08661bb6ce55e4c933ec0
- https://git.kernel.org/stable/c/b4b201cc93ff70150853aba03e14d314d1980ca0
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.