Executive brief
A vulnerability was identified in the Linux kernel's firmware loading mechanism. When the system fails to register a new firmware upload interface, it may fail to properly release internal memory references. This can lead to a memory leak, potentially allowing a local user to exhaust system resources over time or causing instability in system operations.
Technical details
A reference counting error exists in 'drivers/base/firmware_loader/sysfs_upload.c' within the 'firmware_upload_register()' function. When 'fw_create_instance()' succeeds, it initializes a 'struct device', but if a subsequent call to 'alloc_lookup_fw_priv()' fails, the error path directly frees the 'fw_sysfs' structure instead of calling 'put_device()'. This results in a reference leak of the embedded device object. An attacker with the ability to repeatedly trigger this registration failure could cause a kernel memory leak. The issue has been resolved by ensuring 'put_device()' is called in the failure path to allow the device core to manage the object's lifetime correctly.
Affected products
- Linux Linux Kernel 5.19 to 6.1.178, 6.6.145, and other stable branches
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory
References
- https://git.kernel.org/stable/c/15432f19562fdb9199cce6d9fc24db12c71ed574
- https://git.kernel.org/stable/c/2619b47a0c8114eef980a56ade7e3ef4b58eb384
- https://git.kernel.org/stable/c/46d403da376a8b7c1187193294953816e1a8d7fe
- https://git.kernel.org/stable/c/517676ec7dfca064e08f94007a4abd21969de0a0
- https://git.kernel.org/stable/c/896df22ee57648b0c505bd76ddbc6b2341834696
- https://git.kernel.org/stable/c/92f41769e5fd16bcd9ba97500d0517332e0a5b45