CVE-2026-72022

llc: fix SAP refcount leak in llc_ui_autobind()

State: Published
Severity: Not scored
Published: Aug 15, 2026
Updated: Aug 17, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

llc: fix SAP refcount leak in llc_ui_autobind()

llc_ui_autobind() opens a SAP after choosing a dynamic LSAP. llc_sap_open() returns a reference owned by the caller, and llc_sap_add_socket() takes a second reference for the socket's membership in the SAP hash tables.

llc_ui_bind() drops the caller's reference after adding the socket, but llc_ui_autobind() keeps it. When the socket is closed, llc_sap_remove_socket() releases only the socket reference, leaving the SAP on llc_sap_list with sk_count == 0.

This is user-visible because repeated autobind and close cycles can consume all dynamic SAP values and make later autobinds fail with -EUSERS.

Drop the caller's reference after a successful autobind, matching llc_ui_bind()'s ownership model.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 79dc4b508e3f2649390a1f745f7657813e5938ecAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a2f9fa31ae021ef1fdcaf3ab17bd49f9223dd6a4Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b589a965184dde49c43b8caf5bcc65715a7b4ef2Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c7881b6088276601beaccb7440b8d56eab0d65aeAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b2fc9955ddc7c4ca03be44b995193bd6486c62e1Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 61a7ff4a62003b55a15022567486741b3bd83914Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 21a537606fe35be2b85971a5fd35c0023b6ef98fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 660667cd406648bbaffbd5c0d897c2263a852f11Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 79dc4b508e3f2649390a1f745f7657813e5938ecAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before a2f9fa31ae021ef1fdcaf3ab17bd49f9223dd6a4Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b589a965184dde49c43b8caf5bcc65715a7b4ef2Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before c7881b6088276601beaccb7440b8d56eab0d65aeAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b2fc9955ddc7c4ca03be44b995193bd6486c62e1Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 61a7ff4a62003b55a15022567486741b3bd83914Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 21a537606fe35be2b85971a5fd35c0023b6ef98fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 660667cd406648bbaffbd5c0d897c2263a852f11Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.