CVE-2026-64376

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A reference leak exists in the firmware loader. In the firmware upload register() function, if alloc lookup fw priv() fails after fw create instance() has successfully executed, the system calls free fw sysfs and frees fw sysfs directly. This bypasses the necessary put device() call required to release the device reference for the embedded device struct, which was previously initialized by device initialize(). Consequently, the reference count of the embedded device struct remains unbalanced, leading to a refcount leak.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.