CVE-2026-68333

Not scored yetLast modified Aug 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

dpaa2-switch: put MAC endpoint device on disconnect

fsl_mc_get_endpoint() returns the MAC endpoint device with a reference taken through device_find_child(). The switch port connect path stores that device in mac->mc_dev and keeps it for the lifetime of the connected MAC object.

However, the disconnect path only closes the MAC and frees the dpaa2_mac object. It does not drop the endpoint device reference stored in mac->mc_dev, so every successful connect leaks that device reference when the MAC is later disconnected.

Drop the endpoint device reference before freeing the dpaa2_mac object.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 10, 2026
Last modified
Aug 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-68334In the Linux kernel, the following vulnerability has been resolved: rxrpc: fix io_thread race in rxrpc_wake_up_io_thread() rxrpc_wake_up_iCVE-2026-683357.8In the Linux kernel, the following vulnerability has been resolved: rds: drop incoming messages that cross network namespace boundaries rdCVE-2026-68336In the Linux kernel, the following vulnerability has been resolved: bonding: fix devconf_all NULL dereference when IPv6 is disabled When bCVE-2026-68337In the Linux kernel, the following vulnerability has been resolved: bpf: Reject redirect helpers without a bpf_net_context The bpf_redirecCVE-2026-683387.8In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packet_CVE-2026-68339In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: validate Realtek vendor event length btusb_recv_evenCVE-2026-68346.5The a+HRD developed by aEnrich has a Missing Authorization vulnerability, allowing authenticated remote attackers to arbitrarily read databaCVE-2026-683407.7In the Linux kernel, the following vulnerability has been resolved: hwmon: occ: validate poll response sensor blocks The OCC poll responseCVE-2026-683418.8In the Linux kernel, the following vulnerability has been resolved: ovpn: fix use after free in unlock_ovpn() unlock_ovpn() iterates over CVE-2026-68342In the Linux kernel, the following vulnerability has been resolved: ovpn: avoid putting unrelated P2P peer on socket release ovpn_peer_relCVE-2026-683439.1In the Linux kernel, the following vulnerability has been resolved: smb: client: validate DFS referral PathConsumed parse_dfs_referrals() CVE-2026-68344In the Linux kernel, the following vulnerability has been resolved: usb: atm: ueagle-atm: reject descriptors that confuse probe and disconn
CVE-2026-68333: Unscored | Vulnix