CVE-2026-72307mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace()
- —Not scoredno CVSS score yet
- 0.22%Exploitation in 30 daysEPSS · top 87% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() When mlxsw_sp_vrs_lpm_tree_replace() fails after replacing some VRs, the error rollback loop does not correctly revert the preceding replacements. The loop decrements the index but fails to update the vr pointer, which still points to the VR that caused the failure. As a result, the condition and the rollback call always operate on the same VR, potentially calling mlxsw_sp_vr_lpm_tree_replace() multiple times on it while never rolling back the earlier VRs. Those VRs continue to hold a reference to new_tree acquired via mlxsw_sp_lpm_tree_hold(), leaking the reference count of new_tree. Fix by reinitializing vr inside the error loop with the updated index: vr = &mlxsw_sp->router->vrs[i]; so that the loop correctly iterates over all VRs that were actually replaced.
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 2 days later
· 2 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.22% · top 87% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected fc922bb0dd9406dd9897fd47df958789891c380e – < c2c75c45b54f3b12eafb28a4eb47f8821512c1aa
- affected fc922bb0dd9406dd9897fd47df958789891c380e – < 7203ac71d3895fa5948b319dd724f0e1cffbc4a1
- affected fc922bb0dd9406dd9897fd47df958789891c380e – < f6454a5fbf2224ad30ec70e686a6c592561da1f2
- affected fc922bb0dd9406dd9897fd47df958789891c380e – < 220d41bdce41fe5a39a7f419faab1e907b4093c2
- affected fc922bb0dd9406dd9897fd47df958789891c380e – < 9e4a6185679922305ea1df68403f00ccc512656b
- affected fc922bb0dd9406dd9897fd47df958789891c380e – < 3a2b47d1b4b3de54d030a7fdb6a322c970513ee3
- affected fc922bb0dd9406dd9897fd47df958789891c380e – < 8adebf07b46df79a0e49a6d4ae384f0db7c91db6
- affected fc922bb0dd9406dd9897fd47df958789891c380e – < 21cf8dc478a49e8de039c2739b1646a774cb1944
- affected 4.14
- unaffected < 4.14
- unaffected 5.10.261 – ≤ 5.10.*
- unaffected 5.15.212 – ≤ 5.15.*
- unaffected 6.1.178 – ≤ 6.1.*
- unaffected 6.6.145 – ≤ 6.6.*
- unaffected 6.12.97 – ≤ 6.12.*
- unaffected 6.18.40 – ≤ 6.18.*
- unaffected 7.1.5 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/c2c75c45b54f3b12eafb28a4eb47f8821512c1aa (opens in a new tab)
- https://git.kernel.org/stable/c/7203ac71d3895fa5948b319dd724f0e1cffbc4a1 (opens in a new tab)
- https://git.kernel.org/stable/c/f6454a5fbf2224ad30ec70e686a6c592561da1f2 (opens in a new tab)
- https://git.kernel.org/stable/c/220d41bdce41fe5a39a7f419faab1e907b4093c2 (opens in a new tab)
- https://git.kernel.org/stable/c/9e4a6185679922305ea1df68403f00ccc512656b (opens in a new tab)
- https://git.kernel.org/stable/c/3a2b47d1b4b3de54d030a7fdb6a322c970513ee3 (opens in a new tab)
- https://git.kernel.org/stable/c/8adebf07b46df79a0e49a6d4ae384f0db7c91db6 (opens in a new tab)
- https://git.kernel.org/stable/c/21cf8dc478a49e8de039c2739b1646a774cb1944 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-59206 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-72307)Record last updated .