Riskcovery

CVE-2026-53261

devlink: Release nested relation on devlink free

State
Published
Severity
Not scored
Published
Jun 25, 2026
Updated
Jun 25, 2026
Reserved
Jun 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

devlink: Release nested relation on devlink free

devlink relation state is normally released from devl_unregister(), which calls devlink_rel_put(). This misses devlink instances that get a nested relation before registration and then fail probe before devl_register() is reached.

That flow can happen for SFs. The child devlink gets linked to its parent before registration, then a later probe error calls devlink_free() directly. Since the instance was never registered, devl_unregister() is not called and devlink->rel is leaked.

Release any pending relation from devlink_free() as well. The registered path is unchanged because devl_unregister() already clears devlink->rel before devlink_free() runs.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c137743bce02b18c1537d4681aa515f7b80bf0a8 to before a9137286884703113b1c9e6403bd6d7d97b14754Affected
  • c137743bce02b18c1537d4681aa515f7b80bf0a8 to before 927f96861f939c0b517d13ed27bf4fabbfc1cfb3Affected
  • c137743bce02b18c1537d4681aa515f7b80bf0a8 to before 11324d52b0c63f4f202b35793c6507a575e9a689Affected
  • c137743bce02b18c1537d4681aa515f7b80bf0a8 to before 3522b21fd7e1863d0734537737bd59f1b90d0190Affected
LinuxLinux
  • 6.7Affected
  • before 6.7Not affected
  • 6.12.94 through 6.12.*Not affected
  • 6.18.36 through 6.18.*Not affected
  • 7.0.13 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.