0.0
NA
CVE-2026-72307
mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
Overview
Description
In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() When mlxsw_sp_vrs_lpm_tree_replace() fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but fails to update the vr pointer, which still points to the VR that caused the failure. As a result, the condition and the rollback call always operate on the same VR, potentially calling mlxsw_sp_vr_lpm_tree_replace() multiple times on it while never rolling back the earlier VRs. Those VRs continue to hold a reference to new_tree acquired via mlxsw_sp_lpm_tree_hold(), leaking the reference count of new_tree. Fix by reinitializing vr inside the error loop with the updated index: vr = &mlxsw_sp->router->vrs[i]; so that the loop correctly iterates over all VRs that were actually replaced.
Details
INFO
Published Date :
Aug. 15, 2026, 6:22 a.m.
Last Modified :
Aug. 17, 2026, 6:18 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Fix a reference count leak in the Linux kernel by properly reinitializing pointers during error rollback.
- Apply the kernel patch for mlxsw refcount leak.
- Ensure rollback logic correctly updates pointers.
- Reinitialize VR pointer inside error rollback loop.
- Verify all VRs are reverted during rollback.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-72307.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-72307 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-72307
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72307 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72307 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': 'c2c75c45b54f3b12eafb28a4eb47f8821512c1aa', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '7203ac71d3895fa5948b319dd724f0e1cffbc4a1', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': 'f6454a5fbf2224ad30ec70e686a6c592561da1f2', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '220d41bdce41fe5a39a7f419faab1e907b4093c2', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '9e4a6185679922305ea1df68403f00ccc512656b', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '3a2b47d1b4b3de54d030a7fdb6a322c970513ee3', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '8adebf07b46df79a0e49a6d4ae384f0db7c91db6', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '21cf8dc478a49e8de039c2739b1646a774cb1944', 'versionType': 'git'}], 'programFiles': ['drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': 'c2c75c45b54f3b12eafb28a4eb47f8821512c1aa', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '7203ac71d3895fa5948b319dd724f0e1cffbc4a1', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': 'f6454a5fbf2224ad30ec70e686a6c592561da1f2', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '220d41bdce41fe5a39a7f419faab1e907b4093c2', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '9e4a6185679922305ea1df68403f00ccc512656b', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '3a2b47d1b4b3de54d030a7fdb6a322c970513ee3', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '8adebf07b46df79a0e49a6d4ae384f0db7c91db6', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '21cf8dc478a49e8de039c2739b1646a774cb1944', 'versionType': 'git'}], 'programFiles': ['drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 15, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': 'c2c75c45b54f3b12eafb28a4eb47f8821512c1aa', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '7203ac71d3895fa5948b319dd724f0e1cffbc4a1', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': 'f6454a5fbf2224ad30ec70e686a6c592561da1f2', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '220d41bdce41fe5a39a7f419faab1e907b4093c2', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '9e4a6185679922305ea1df68403f00ccc512656b', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '3a2b47d1b4b3de54d030a7fdb6a322c970513ee3', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '8adebf07b46df79a0e49a6d4ae384f0db7c91db6', 'versionType': 'git'}, {'status': 'affected', 'version': 'fc922bb0dd9406dd9897fd47df958789891c380e', 'lessThan': '21cf8dc478a49e8de039c2739b1646a774cb1944', 'versionType': 'git'}], 'programFiles': ['drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() When mlxsw_sp_vrs_lpm_tree_replace() fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but fails to update the vr pointer, which still points to the VR that caused the failure. As a result, the condition and the rollback call always operate on the same VR, potentially calling mlxsw_sp_vr_lpm_tree_replace() multiple times on it while never rolling back the earlier VRs. Those VRs continue to hold a reference to new_tree acquired via mlxsw_sp_lpm_tree_hold(), leaking the reference count of new_tree. Fix by reinitializing vr inside the error loop with the updated index: vr = &mlxsw_sp->router->vrs[i]; so that the loop correctly iterates over all VRs that were actually replaced. Added Reference https://git.kernel.org/stable/c/21cf8dc478a49e8de039c2739b1646a774cb1944 Added Reference https://git.kernel.org/stable/c/220d41bdce41fe5a39a7f419faab1e907b4093c2 Added Reference https://git.kernel.org/stable/c/3a2b47d1b4b3de54d030a7fdb6a322c970513ee3 Added Reference https://git.kernel.org/stable/c/7203ac71d3895fa5948b319dd724f0e1cffbc4a1 Added Reference https://git.kernel.org/stable/c/8adebf07b46df79a0e49a6d4ae384f0db7c91db6 Added Reference https://git.kernel.org/stable/c/9e4a6185679922305ea1df68403f00ccc512656b Added Reference https://git.kernel.org/stable/c/c2c75c45b54f3b12eafb28a4eb47f8821512c1aa Added Reference https://git.kernel.org/stable/c/f6454a5fbf2224ad30ec70e686a6c592561da1f2
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.