Executive brief
The IXP4xx HSS network driver contains a resource allocation bug where the probe function allocates HDLC network devices twice but only uses one of them, while the other is never unregistered. This causes memory leaks and potential data corruption if the remove path tries to clean up the wrong device object, affecting systems that rely on this WAN driver for network connectivity.
Technical details
The vulnerability is a resource management flaw in the ixp4xx_hss_probe() function in drivers/net/wan/ixp4xx_hss.c. The code allocates two separate HDLC netdev objects via alloc_hdlcdev() but stores them in different variables (ndev and port->netdev). The first allocation (ndev) is registered and initialized, but the second allocation (port->netdev) is what the remove path cleans up via unregister_hdlc_device() and free_netdev(). This mismatch causes the registered device to never be unregistered and leaks memory if the second alloc_hdlcdev() fails. The fix consolidates to a single allocation, assigning the same object to both ndev and port->netdev. No authentication or network access is required; the bug manifests during driver probe/remove sequences. The patch has been merged into the stable kernel.
Affected products
- Linux Linux kernel multiple versions (see stable branches referenced)
Timeline
- 2026-06-22: other: Patch authored
- 2026-07-24: patched: Merged into stable tree
- 2026-08-15: disclosed