CVE-2026-53261 Linux Kernel devlink Memory Leak: SF Device Probe Failures

Technical summary

CVE-2026-53261 is a resource leak in the Linux kernel's devlink relation management code. The vulnerability occurs because devlink_rel_put() is only called from devl_unregister(), which handles normal device unregistration. However, some code paths—particularly involving SubFunction (SF) devices—establish a parent-child devlink relation before calling devl_register(). If a probe error occurs before registration completes, devlink_free() is called directly, bypassing devl_unregister() and leaving the devlink->rel reference unreleased. The fix adds relation cleanup to devlink_free() to catch these early-failure scenarios while preserving the existing registered-path behavior where devl_unregister() already clears the reference before devlink_free() executes.

Business impact

The practical impact is limited to systems running affected kernel versions where SF driver probe failures are common or where aggressive device hot-plug/unplug cycles occur. Each leaked relation consumes kernel memory and can contribute to memory exhaustion over time if the failure condition is repeatedly triggered. For most production environments, the impact is low unless driver probe failures are endemic; however, container orchestration platforms or systems with frequent device enumeration changes could be more sensitive.

Affected systems

All Linux kernel versions up to the time of this fix are potentially affected. The vulnerability is most relevant on systems using SubFunction (SF) device drivers, which are common in modern network adapters and storage controllers that support SR-IOV or similar hardware virtualization. Embedded systems, edge devices, and cloud infrastructure with hot-pluggable or virtualized network/storage hardware are more likely to encounter this issue.

Exploitability

This is not a remote vulnerability and does not provide a direct attack surface. Exploitation requires either: (1) local system access to trigger device probe failures repeatedly, or (2) ability to hot-plug devices and force probe errors. The vulnerability is a resource leak that compounds over time rather than a means to gain unauthorized access or execute code. The CVSS score of 5.5 (Medium) reflects availability impact through memory exhaustion, not confidentiality or integrity compromise.

Remediation

Apply the upstream Linux kernel patch that adds devlink relation cleanup to devlink_free(). Verify the patch is included in your kernel version by checking the release notes or git history of your Linux distribution. For systems unable to patch immediately, monitor kernel memory usage on systems with active SF device drivers and minimize probe failure scenarios through driver validation and stable hardware configuration.

Patch guidance

Check your Linux distribution's kernel update channels for versions that include this devlink fix. The fix is straightforward and low-risk since it adds cleanup to an error path rather than modifying core functionality. Verify the patch commit is present in your kernel by consulting your vendor's advisory or the kernel.org git repository. Most major distributions (Red Hat, Debian, Ubuntu, SUSE) will backport this to their supported kernel branches.

Detection guidance

Monitor kernel memory usage trends, particularly on systems with SF devices. Watch for repeating device probe error messages in kernel logs that correlate with memory growth. On systems with debugfs enabled, inspect /sys/kernel/debug/devlink for orphaned relation entries. Use kernel leak detection tools (kmemleak) if enabled in your kernel build to identify unreleased devlink relations.

Why prioritize this

This vulnerability is a local resource leak with medium severity. Prioritize patching systems where: (1) SF devices (network adapters, storage controllers with virtualization support) are present and actively used, (2) driver probe failures or frequent device hot-plug events occur, or (3) long-running systems where memory accumulation is a concern. Standard deployments without these risk factors can follow standard patch cycles.

Risk score, explained

CVSS 5.5 (Medium) reflects availability impact only—no confidentiality or integrity risk. The attack vector is local, requires low privilege, and causes denial of service through resource exhaustion. The score appropriately captures that this is a slow-burn reliability issue rather than an acute security threat, but underscores the importance of patching systems with high device churn.

Frequently asked questions