CVE-2026-97972: net: macb: put the "mdio" child node reference on success
In the Linux kernel, the following vulnerability has been resolved:
net: macb: put the "mdio" child node reference on success
macbmiiinit() holds the reference returned by ofgetchildbyname() for macbmdiobusregister() and drops it only on the error paths, so every successful probe leaks a node reference. On a CM5, overlay removal after four bind cycles reports
OF: ERROR: memory leak, expected refcount 1 instead of 5
Drop the reference after registration, where mdiobusregister() has already taken its own for the lifetime of the bus.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
When does the reference leak occur?
The leak occurs on each successful probe of the macb driver, because the MDIO child-node reference is released on error paths but not after successful registration.
What operational symptom can indicate that a system is affected?
Repeated bind cycles followed by device-tree overlay removal can trigger an OF memory-leak report. The reported condition is an unexpected node reference count greater than the expected count of 1; the described CM5 test reached 5 after four bind cycles.
Is this limited to failed driver initialization?
No. Failed initialization already drops the child-node reference on error paths. The affected path is successful registration, after which the reference should be released because the MDIO bus registration has taken its own lifetime reference.