CVE-2026-72022

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A reference count leak exists in the llc ui autobind() function. The function opens a Service Access Point (SAP) after selecting a dynamic Logical Link Control Service Access Point (LSAP). While llc sap open() returns a reference owned by the caller and llc sap add socket() creates a second reference for the socket's membership in SAP hash tables, llc ui autobind() fails to drop the caller's reference. Consequently, when the socket is closed, llc sap remove socket() only releases the socket reference, leaving the SAP on the llc sap list with a sk count of 0. This can lead to the exhaustion of all dynamic SAP values through repeated autobind and close cycles, causing subsequent autobind attempts to fail with an -EUSERS error.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.