Strix
56.7K

CVE-2026-72308

UnknownEPSS 0.21%

Last modified

CVE-2026-72308 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() When mlxsw_sp_port_lag_index_get() fails, mlxsw_sp_port_lag_join() returns an error without releasing the lag reference obtained by the earlier mlxsw_sp_lag_get(). All other error paths in the function jump to the cleanup label that ends with mlxsw_sp_lag_put(), so this is a single missed release. Fix the leak by replacing the bare 'return err' with a goto to the existing error cleanup label, which will drop the reference safely.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() When mlxsw_sp_port_lag_index_get() fails, mlxsw_sp_port_lag_join() returns an error without releasing the lag reference obtained by the earlier mlxsw_sp_lag_get(). All other error paths in the function jump to the cleanup label that ends with mlxsw_sp_lag_put(), so this is a single missed release. Fix the leak by replacing the bare 'return err' with a goto to the existing error cleanup label, which will drop the reference safely.

Metrics

EPSS Probability
0.21%

11.4th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 0d65fc13042fce6a2d6de58ff0dc9531e8523c07, < 8b3350eacd9df0597bfe36a594df7b9def0b3edf; >= 0d65fc13042fce6a2d6de58ff0dc9531e8523c07, < 1cf8a1af42b1f12a30b7abd34fe4fc23b3170e7e; >= 0d65fc13042fce6a2d6de58ff0dc9531e8523c07, < 2d8b3c3e129973a51ae924bdcf6993a76b828814; >= 0d65fc13042fce6a2d6de58ff0dc9531e8523c07, < cab468c3c03f4bcd7530ce2783a4140da14efb7b; >= 0d65fc13042fce6a2d6de58ff0dc9531e8523c07, < 41c8c1d65b32beacd8d916a22457b4f6e47f45af
LinuxLinux4.5

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-72308?
In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() When mlxsw_sp_port_lag_index_get() fails, mlxsw_sp_port_lag_join() returns an error without releasing the lag reference obtained by the earlier mlxsw_sp_lag_get(). All other error paths in the function jump to the cleanup label that ends with mlxsw_sp_lag_put(), so this is a single missed release. Fix the leak by replacing the bare 'return err' with a goto to the existing error cleanup label, which will drop the reference safely.
How severe is CVE-2026-72308?
Severity scoring for CVE-2026-72308 is pending analysis. The EPSS model estimates a 0.21% probability of exploitation in the next 30 days.
How do I fix CVE-2026-72308?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-72308?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST