Executive brief
A vulnerability in the Linux kernel's MCTP (Management Component Transport Protocol) USB driver could lead to a memory leak. This occurs because the system fails to properly release hardware references when a device connection attempt fails. Over time, such leaks can degrade system performance or lead to instability, potentially impacting the availability of services relying on MCTP communication.
Technical details
A resource leak exists in drivers/net/mctp/mctp-usb.c within the Linux kernel. The mctp_usb_probe function incorrectly takes an additional reference to the USB device using usb_get_dev() but fails to release it if the probe process subsequently fails. Since the driver core already maintains a reference to the USB interface and its parent device while bound, the extra reference was redundant and caused a leak. An attacker with the ability to trigger repeated probe failures (e.g., via physical device manipulation or local driver interaction) could potentially cause a denial-of-service through memory exhaustion. The issue has been resolved by removing the redundant reference increment.
Affected products
- Linux Linux Kernel 6.15
Timeline
- 2026-03-05: patched: Initial patch authored by Johan Hovold
- 2026-05-08: disclosed: CVE-2026-43375 published