Executive brief
A memory leak vulnerability was identified in the Linux kernel's devlink component, which manages network device resources. Under specific error conditions during hardware initialization, the system fails to properly release memory associated with device relationships. While this primarily impacts system stability over time by consuming resources, it does not directly expose user data.
Technical details
A resource leak exists in net/devlink/core.c due to improper handling of nested relations during device probe failures. Normally, devlink relation state is released via devl_unregister(), which calls devlink_rel_put(). However, if a child devlink (such as a Subfunction/SF) is linked to a parent before registration and subsequently encounters a probe error, devlink_free() is called directly without devl_unregister(). This bypasses the cleanup logic, leading to a leak of devlink->rel. The fix involves explicitly calling devlink_rel_put() within devlink_free() to ensure resources are released regardless of registration status.
Affected products
- Linux Linux Kernel 6.7 to 7.1
Timeline
- 2026-06-25: advisory: NVD publication date
- 2026-06-01: patched: Mainline kernel patch applied