CVE-2026-43375: net: mctp: fix device leak on probe failure
In the Linux kernel, the following vulnerability has been resolved:
net: mctp: fix device leak on probe failure
Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect.
This driver takes a reference to the USB device during probe but does not to release it on probe failures.
Drop the redundant device reference to fix the leak, reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of further memory leaks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.10-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43375?
The severity of CVE-2026-43375 is categorized as a medium risk due to potential resource leaks.
How do I fix CVE-2026-43375?
To fix CVE-2026-43375, update the Linux kernel to version 6.15 or later, ensuring that the vulnerable mctp driver is addressed.
What causes CVE-2026-43375?
CVE-2026-43375 is caused by a device leak occurring during the probe failure process in the mctp driver.
Which Linux kernel versions are affected by CVE-2026-43375?
CVE-2026-43375 affects Linux kernel versions from 6.15 up to 6.19.9 and includes specific release candidates like 7.0-rc1 to 7.0-rc3.
Is CVE-2026-43375 being actively exploited?
As of now, there are no known active exploits for CVE-2026-43375, but it is recommended to apply patches promptly.