Executive brief
The Linux kernel's devlink subsystem, which manages network device configuration and management, fails to properly clean up memory references in specific error conditions during device reload operations. This reference leak can gradually consume system memory when reload operations encounter certain errors, potentially leading to system memory exhaustion and denial of service.
Technical details
The vulnerability is a reference leak (CWE-401) in the devlink netlink interface. The function devlink_nl_reload_doit() calls devlink_netns_get() which increments the reference count on a network namespace object. When the requested namespace differs from the current namespace and the reload action is not DRIVER_REINIT, the function returns -EOPNOTSUPP error without decrementing the reference via put_net(). This causes the namespace object to remain referenced, preventing garbage collection. The attack vector is local; an unprivileged user with CAP_NET_ADMIN capability can trigger the error path repeatedly by issuing devlink reload commands with unsupported namespace parameters. A patch adding put_net(dest_net) on the error path was merged in kernel commit 1c4dac9bf1d2ac31da63b794bdec697777cbd0fd on 2026-07-31.
Affected products
- Linux Linux kernel kernel versions prior to patched commit 1c4dac9bf1d2ac31da63b794bdec697777cbd0fd
Timeline
- 2026-08-22: disclosed
- 2026-07-31: patched