CVE-2026-43375net: mctp: fix device leak on probe failure
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: mctp: fix device leak on probe failure Driver core holds a reference to the USB interface and its parent USB device while the interface is bound to a driver and there is no need to take additional references unless the structures are needed after disconnect. This driver takes a reference to the USB device during probe but does not to release it on probe failures. Drop the redundant device reference to fix the leak, reduce cargo culting, make it easier to spot drivers where an extra reference is needed, and reduce the risk of further memory leaks.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- May 11, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0791c0327a6e4e7691d6fc5ad334c215de04dcc9 before 3224990fb16a831aabc50b67c74f5d0074ce80dd; from 0791c0327a6e4e7691d6fc5ad334c215de04dcc9 before ec9538f9b5cd1db5e8c612aa636b6119b6355c5d; 0791c0327a6e4e7691d6fc5ad334c215de04dcc9 builds before 224a0d284c3caf1951302d1744a714784febed71 | CNA record |
linux linux_kernel linux:linux_kernel | from 6.15 before 6.18.19; from 6.19 before 6.19.9; 7.0; 7.0; 7.0 | NVD |
References
- https://git.kernel.org/stable/c/3224990fb16a831aabc50b67c74f5d0074ce80ddpatch
- https://git.kernel.org/stable/c/ec9538f9b5cd1db5e8c612aa636b6119b6355c5dpatch
- https://git.kernel.org/stable/c/224a0d284c3caf1951302d1744a714784febed71patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.