Executive brief
A vulnerability in the Broadcom SBA RAID driver within the Linux kernel could allow a local user to cause a resource leak. This occurs because the system fails to properly release hardware references during certain initialization failures or when the driver is stopped. Over time, this could lead to system instability or a denial-of-service condition.
Technical details
A resource management vulnerability exists in the dmaengine component of the Linux kernel, specifically within the bcm-sba-raid.c driver. The root cause is a failure to call put_device() on the mailbox device reference when the sba_probe function encounters an error or when sba_remove is executed. This results in a reference count leak. An attacker with local access could potentially exploit this to exhaust system resources, leading to a denial-of-service (DoS). The issue has been patched across multiple stable kernel branches by ensuring the reference is dropped in the appropriate error paths and during driver unbind.
Affected products
- Linux Linux Kernel 4.13 to 5.10.249, 5.11 to 5.15.199, 5.16 to 6.1.162, 6.2 to 6.6.122, 6.7 to 6.12.67, 6.13 to 6.18.7
Timeline
- 2025-11-17: other: Patch authored
- 2026-01-31: disclosed: CVE published
- 2026-01-23: patched: Patch committed to stable tree
References
- https://git.kernel.org/stable/c/2ed1a9de1f2d727ccae5bc9cc7c63ee3519c0c8b
- https://git.kernel.org/stable/c/4316e4c4fd2c09f68a262365f21847cafa8fe9dd
- https://git.kernel.org/stable/c/4730f12a192d7314119b3d8331611ab151b87bdf
- https://git.kernel.org/stable/c/7c3a46ebf15a9796b763a54272407fdbf945bed8
- https://git.kernel.org/stable/c/bc98e68adfef3b25c06ff08f0808bb59f787420c
- https://git.kernel.org/stable/c/c80ca7bdff158401440741bdcf9175bd8608580b
- https://git.kernel.org/stable/c/db6f1d6d31711e73e6a214c73e6a8fb4cda0483d