CVE-2026-68331 - Vulnerability Details

- dpaa2-eth: put MAC endpoint device on disconnect

Description

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-eth: put MAC endpoint device on disconnect

fsl_mc_get_endpoint() returns the MAC endpoint device with a reference
taken through device_find_child(). The Ethernet connect path stores that
device in mac->mc_dev and keeps it for the lifetime of the connected MAC
object.

However, the disconnect path only disconnects and closes the MAC before
freeing the dpaa2_mac object. It does not drop the endpoint device
reference stored in mac->mc_dev, so every successful connect leaks that
device reference when the MAC is later disconnected.

Drop the endpoint device reference after closing the MAC and before
freeing the dpaa2_mac object.

Published: 2026-08-10

Score: 5.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The dpaa2‑eth driver in the Linux kernel mishandles the release of a MAC endpoint device when a MAC is disconnected. A reference to the endpoint device is retained even after the MAC is closed, resulting in a resource leak. Repeated connect and disconnect operations can accumulate unreleased references, potentially exhausting system memory or other resources and degrading system performance or availability.

Affected Systems

The vulnerability affects the Linux operating system’s kernel, specifically the dpaa2‑eth driver responsible for managing Ethernet MAC endpoints. No specific kernel versions are listed, so all kernels that include this driver prior to the commit that fixed the issue are potentially affected.

Risk and Exploitability

The EPSS score is < 1%, and the CVSS score of 5.9 indicates moderate severity. The vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. Exploitation would require local kernel or elevated privileges to repeatedly connect and disconnect MAC interfaces. The absence of a public exploit does not negate the risk of a denial‑of‑service scenario through resource exhaustion caused by the reference leak.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`71947923089353f23f4f210864903c4dcf2c1696`	affected	< 6b6ffdb9ca4547a3c4c274aa3e25b6c68dbc62e1
`71947923089353f23f4f210864903c4dcf2c1696`	affected	< 1974127776da46a000c61f36d4946799ea6d4f51
`71947923089353f23f4f210864903c4dcf2c1696`	affected	< 915012e923316b8b5d5bf8fc771617b47bd7572d
`71947923089353f23f4f210864903c4dcf2c1696`	affected	< e23e4a3b9dfd893469c731318d409cdf04fb1ddf
`71947923089353f23f4f210864903c4dcf2c1696`	affected	< f112df0744e2d77baa68eeebb860021bbaaa022a
`71947923089353f23f4f210864903c4dcf2c1696`	affected	< a3cecf169cc652b558d08661bb6ce55e4c933ec0
`71947923089353f23f4f210864903c4dcf2c1696`	affected	< b4b201cc93ff70150853aba03e14d314d1980ca0

Linux

affected

Version	Status	Constraints
`5.5`	affected	—
`0`	unaffected	< 5.5
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[71947923089353f23f4f210864903c4dcf2c1696,915012e923316b8b5d5bf8fc771617b47bd7572d)`	affected	code_commit	—
`[71947923089353f23f4f210864903c4dcf2c1696,e23e4a3b9dfd893469c731318d409cdf04fb1ddf)`	affected	code_commit	—
`[71947923089353f23f4f210864903c4dcf2c1696,f112df0744e2d77baa68eeebb860021bbaaa022a)`	affected	code_commit	—
`[71947923089353f23f4f210864903c4dcf2c1696,a3cecf169cc652b558d08661bb6ce55e4c933ec0)`	affected	code_commit	—
`[71947923089353f23f4f210864903c4dcf2c1696,b4b201cc93ff70150853aba03e14d314d1980ca0)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.5`	affected	semver	—
`[0,5.5)`	unaffected	semver	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a Linux kernel update that includes the dpaa2‑eth fix (the commit that drops the endpoint reference should be present in newer kernels).
If an update is not possible, disable or unload the dpaa2‑eth driver or the networking interfaces that use it to prevent the leak from occurring.
Configure system monitoring to detect abnormal increases in memory or device handle usage associated with dpaa2 MAC devices, and take remedial action if the leak is observed.

Generated by OpenCVE AI on August 12, 2026 at 18:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00172.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1974127776da46a000c61f36d4946799ea6d4f51
https://git.kernel.org/stable/c/6b6ffdb9ca4547a3c4c274aa3e25b6c68dbc62e1
https://git.kernel.org/stable/c/915012e923316b8b5d5bf8fc771617b47bd7572d
https://git.kernel.org/stable/c/a3cecf169cc652b558d08661bb6ce55e4c933ec0
https://git.kernel.org/stable/c/b4b201cc93ff70150853aba03e14d314d1980ca0
https://git.kernel.org/stable/c/e23e4a3b9dfd893469c731318d409cdf04fb1ddf
https://git.kernel.org/stable/c/f112df0744e2d77baa68eeebb860021bbaaa022a
https://nvd.nist.gov/vuln/detail/CVE-2026-68331
https://www.cve.org/CVERecord?id=CVE-2026-68331

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/1974127776da46a000c61f36d4946799ea6d4f51 https://git.kernel.org/stable/c/6b6ffdb9ca4547a3c4c274aa3e25b6c68dbc62e1

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-68331 https://www.cve.org/CVERecord?id=CVE-2026-68331
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-400

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: dpaa2-eth: put MAC endpoint device on disconnect fsl_mc_get_endpoint() returns the MAC endpoint device with a reference taken through device_find_child(). The Ethernet connect path stores that device in mac->mc_dev and keeps it for the lifetime of the connected MAC object. However, the disconnect path only disconnects and closes the MAC before freeing the dpaa2_mac object. It does not drop the endpoint device reference stored in mac->mc_dev, so every successful connect leaks that device reference when the MAC is later disconnected. Drop the endpoint device reference after closing the MAC and before freeing the dpaa2_mac object.
Title		dpaa2-eth: put MAC endpoint device on disconnect
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/915012e923316b8b5d5bf8fc771617b47bd7572d https://git.kernel.org/stable/c/a3cecf169cc652b558d08661bb6ce55e4c933ec0 https://git.kernel.org/stable/c/b4b201cc93ff70150853aba03e14d314d1980ca0 https://git.kernel.org/stable/c/e23e4a3b9dfd893469c731318d409cdf04fb1ddf https://git.kernel.org/stable/c/f112df0744e2d77baa68eeebb860021bbaaa022a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:03:07.529Z

Updated: 2026-08-19T16:33:28.174Z

Reserved: 2026-07-30T09:28:09.383Z

Link: CVE-2026-68331

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:20:23.410

Modified: 2026-08-19T17:20:43.260

Link: CVE-2026-68331

Redhat

Severity : Moderate

Publid Date: 2026-08-10T12:03:07Z

Links: CVE-2026-68331 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-12T18:30:06Z

Weaknesses

CWE-400
Uncontrolled Resource Consumption
CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object