Executive brief
The Linux kernel's LLC (Logical Link Control) socket implementation contains a reference counting bug in the autobind function that allows attackers or local users to exhaust all available dynamic SAP (Service Access Point) resources. By repeatedly binding and closing sockets, an attacker can consume all 256 dynamic SAP values, causing subsequent socket binding attempts to fail and potentially denying service to legitimate applications.
Technical details
The vulnerability is a reference counting leak in the llc_ui_autobind() function in net/llc/af_llc.c. The llc_sap_open() function returns a SAP reference owned by the caller; llc_sap_add_socket() increments the reference for socket membership. The buggy autobind path fails to release the caller's reference after successfully adding the socket, whereas the correct llc_ui_bind() path does release it. This causes SAP objects to remain on llc_sap_list with sk_count == 0 after socket closure, preventing their reuse. The fix adds a single llc_sap_put() call to match the ownership model of llc_ui_bind(). This is a local resource exhaustion issue affecting any process that repeatedly opens and closes LLC sockets with autobind.
Affected products
- Linux Linux kernel 2.6.12 and later (prior to fix on 2026-07-24)
Timeline
- 2026-08-15: disclosed: CVE-2026-72022 published
- 2026-07-24: patched: Fix committed to stable kernel trees