In the Linux kernel, the following vulnerability has been resolved:

llc: fix SAP refcount leak in llc_ui_autobind()

llc_ui_autobind() opens a SAP after choosing a dynamic LSAP.
llc_sap_open() returns a reference owned by the caller, and
llc_sap_add_socket() takes a second reference for the socket's
membership in the SAP hash tables.

llc_ui_bind() drops the caller's reference after adding the socket,
but llc_ui_autobind() keeps it. When the socket is closed,
llc_sap_remove_socket() releases only the socket reference, leaving
the SAP on llc_sap_list with sk_count == 0.

This is user-visible because repeated autobind and close cycles can consume
all dynamic SAP values and make later autobinds fail with -EUSERS.

Drop the caller's reference after a successful autobind, matching
llc_ui_bind()'s ownership model.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/21a537606fe35be2b85971a5fd35c0023b6ef98f cve-icon cve-icon
https://git.kernel.org/stable/c/61a7ff4a62003b55a15022567486741b3bd83914 cve-icon cve-icon
https://git.kernel.org/stable/c/660667cd406648bbaffbd5c0d897c2263a852f11 cve-icon cve-icon
https://git.kernel.org/stable/c/79dc4b508e3f2649390a1f745f7657813e5938ec cve-icon cve-icon
https://git.kernel.org/stable/c/a2f9fa31ae021ef1fdcaf3ab17bd49f9223dd6a4 cve-icon cve-icon
https://git.kernel.org/stable/c/b2fc9955ddc7c4ca03be44b995193bd6486c62e1 cve-icon cve-icon
https://git.kernel.org/stable/c/b589a965184dde49c43b8caf5bcc65715a7b4ef2 cve-icon cve-icon
https://git.kernel.org/stable/c/c7881b6088276601beaccb7440b8d56eab0d65ae cve-icon cve-icon
History

Sat, 15 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llc_ui_autobind() llc_ui_autobind() opens a SAP after choosing a dynamic LSAP. llc_sap_open() returns a reference owned by the caller, and llc_sap_add_socket() takes a second reference for the socket's membership in the SAP hash tables. llc_ui_bind() drops the caller's reference after adding the socket, but llc_ui_autobind() keeps it. When the socket is closed, llc_sap_remove_socket() releases only the socket reference, leaving the SAP on llc_sap_list with sk_count == 0. This is user-visible because repeated autobind and close cycles can consume all dynamic SAP values and make later autobinds fail with -EUSERS. Drop the caller's reference after a successful autobind, matching llc_ui_bind()'s ownership model.
Title llc: fix SAP refcount leak in llc_ui_autobind()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:51:47.978Z

Reserved: 2026-08-09T03:40:39.900Z

Link: CVE-2026-72022

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:21:01.193

Modified: 2026-08-15T06:21:01.193

Link: CVE-2026-72022

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T08:15:04Z

Weaknesses