CVE-2026-64376

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

firmware_loader: fix device reference leak in firmware_upload_register()

firmware_upload_register()

-> fw_create_instance()

-> device_initialize()

After fw_create_instance() succeeds, the lifetime of the embedded struct

device is expected to be managed through the device core reference

counting, since fw_create_instance() has already called

device_initialize().

In firmware_upload_register(), if alloc_lookup_fw_priv() fails after

fw_create_instance() succeeds, the code reaches free_fw_sysfs and frees

fw_sysfs directly instead of releasing the device reference with

put_device(). This may leave the reference count of the embedded struct

device unbalanced, resulting in a refcount leak.

The issue was identified by a static analysis tool I developed and

confirmed by manual review. Fix this by using put_device(fw_dev) in the

failure path and letting fw_dev_release() handle the final cleanup,

instead of freeing the

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References