CVE-2026-72022

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

llc: fix SAP refcount leak in llc_ui_autobind()

llc_ui_autobind() opens a SAP after choosing a dynamic LSAP.

llc_sap_open() returns a reference owned by the caller, and

llc_sap_add_socket() takes a second reference for the socket's

membership in the SAP hash tables.

llc_ui_bind() drops the caller's reference after adding the socket,

but llc_ui_autobind() keeps it. When the socket is closed,

llc_sap_remove_socket() releases only the socket reference, leaving

the SAP on llc_sap_list with sk_count == 0.

This is user-visible because repeated autobind and close cycles can consume

all dynamic SAP values and make later autobinds fail with -EUSERS.

Drop the caller's reference after a successful autobind, matching

llc_ui_bind()'s ownership model.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References