Cloudanix VulnDB

CVE-2026-68333

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux kernel networking code for certain hardware can slowly use up system resources if network connections are repeatedly made and broken, potentially making the system unstable.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

A reference count leak in the dpaa2-switch driver causes the MAC endpoint device reference obtained via device_find_child() to not be released on disconnect, resulting in a resource leak each time a MAC is connected and later disconnected.

Why it matters to the business

Over time, repeated connect/disconnect operations on affected systems can lead to gradual resource exhaustion, potentially causing system instability or requiring reboots in environments using DPAA2 networking hardware; low urgency given absence from known exploited vulnerabilities lists and declining exploit prediction score.

How an attack unfolds

An attacker with the ability to trigger repeated MAC connect and disconnect operations on a system running the vulnerable kernel can exhaust device references, leading to resource depletion. No specific threat actors or ransomware campaigns are associated with this issue.

How to fix it

Update to a kernel version that includes the fix for the reference leak in dpaa2-switch disconnect path by dropping the endpoint device reference before freeing the dpaa2_mac object.

How to confirm the fix worked

Review kernel source for the presence of the put_device or equivalent reference drop in the disconnect function before freeing dpaa2_mac object; test repeated connect/disconnect cycles and verify stable device reference counts.

Typical attack path

  1. Identify a vulnerable Linux kernel with dpaa2-switch driver
  2. Gain local access or control over network configuration to trigger MAC connections
  3. Repeatedly connect and disconnect MAC endpoints
  4. Monitor for resource exhaustion symptoms

How to detect it

Examine system logs for repeated MAC connect/disconnect events and monitor memory or reference counts in the kernel; no specific indicators of active exploitation as this is a leak rather than a direct code execution vector.

What your security team should do

  • Apply kernel updates promptly when available for the dpaa2-switch component
  • Monitor for unusual resource usage in networking subsystems on DPAA2 hardware
  • Limit unprivileged access to network configuration interfaces that could trigger repeated MAC operations

The record

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: put MAC endpoint device on disconnect fsl_mc_get_endpoint() returns the MAC endpoint device with a reference taken through device_find_child(). The switch port connect path stores that device in mac->mc_dev and keeps it for the lifetime of the connected MAC object. However, the disconnect path only closes the MAC and frees the dpaa2_mac object. It does not drop the endpoint device reference stored in mac->mc_dev, so every successful connect leaks that device reference when the MAC is later disconnected. Drop the endpoint device reference before freeing the dpaa2_mac object.

Affected packages

Ecosystem Package Introduced Fixed