CVE-2026-72022: llc: fix SAP refcount leak in llc_ui_autobind()
In the Linux kernel, the following vulnerability has been resolved:
llc: fix SAP refcount leak in llcuiautobind()
llcuiautobind() opens a SAP after choosing a dynamic LSAP. llcsapopen() returns a reference owned by the caller, and llcsapaddsocket() takes a second reference for the socket's membership in the SAP hash tables.
llcuibind() drops the caller's reference after adding the socket, but llcuiautobind() keeps it. When the socket is closed, llcsapremovesocket() releases only the socket reference, leaving the SAP on llcsaplist with skcount == 0.
This is user-visible because repeated autobind and close cycles can consume all dynamic SAP values and make later autobinds fail with -EUSERS.
Drop the caller's reference after a successful autobind, matching llcuibind()'s ownership model.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72022?
CVE-2026-72022 has a risk score of 17, indicating a critical vulnerability in the Linux kernel.
How do I fix CVE-2026-72022?
To fix CVE-2026-72022, update the Linux kernel to the latest patched version that addresses this specific vulnerability.
What systems are affected by CVE-2026-72022?
CVE-2026-72022 affects systems running vulnerable versions of the Linux kernel.
Can CVE-2026-72022 cause data loss?
Yes, CVE-2026-72022 may lead to potential data loss due to resource leak issues in the kernel.
Is there a workaround for CVE-2026-72022?
There is no known effective workaround for CVE-2026-72022; applying the kernel update is the recommended action.