In the Linux kernel, the following vulnerability has been resolved:
devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driver-specific `rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing the parent's refcount, without actually setting the `devlink_rate->parent` pointer to NULL.
This leaves a dangling pointer in the `devlink_rate` struct, which cause refcount error in netdevsim[1] and mlx5[2]. In addition, this is inconsistent with the behavior of `devlink_nl_rate_parent_node_set`, where the parent pointer is correctly cleared.
This patch fixes the issue by explicitly setting `devlink_rate->parent` to NULL after notifying the driver, thus fulfilling the function's documented behavior for all rate objects.
[1] repro steps: echo 1 > /sys/bus/netdevsim/new_device devlink dev eswitch set netdevsim/netdevsim1 mode switchdev echo 1 > /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs devlink port function rate add netdevsim/netdevsim1/test_node devlink port function rate set netdevsim/netdevsim1/128 parent test_node echo 1 > /sys/bus/netdevsim/del_device
dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: <TASK> devl_rate_leaf_destroy+0x8d/0x90 __nsim_dev_port_del+0x6c/0x70 [netdevsim] nsim_dev_reload_destroy+0x11c/0x140 [netdevsim] nsim_drv_remove+0x2b/0xb0 [netdevsim] device_release_driver_internal+0x194/0x1f0 bus_remove_device+0xc6/0x130 device_del+0x159/0x3c0 device_unregister+0x1a/0x60 del_device_store+0x111/0x170 [netdevsim] kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x55/0x10f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
[2] devlink dev eswitch set pci/0000:08:00.0 mode switchdev devlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000 devlink port function rate add pci/0000:08:00.0/group1 devlink port function rate set pci/0000:08:00.0/32768 parent group1 modprobe -r mlx5_ib mlx5_fwctl mlx5_core
dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 7 PID: 16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: <TASK> devl_rate_leaf_destroy+0x8d/0x90 mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core] mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core] mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core] mlx5_sf_esw_event+0xc4/0x120 [mlx5_core] notifier_call_chain+0x33/0xa0 blocking_notifier_call_chain+0x3b/0x50 mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core] mlx5_eswitch_disable+0x63/0x90 [mlx5_core] mlx5_unload+0x1d/0x170 [mlx5_core] mlx5_uninit_one+0xa2/0x130 [mlx5_core] remove_one+0x78/0xd0 [mlx5_core] pci_device_remove+0x39/0xa0 device_release_driver_internal+0x194/0x1f0 unbind_store+0x99/0xa0 kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x53/0x1f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debugUpgrade kernel-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-modules-coreUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-64k-debugUpgrade rtlaUpgrade kernel-rt-64k-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-devel-matchedUpgrade kernel-rt-modules-extraUpgrade kernel-modules-coreUpgrade kernel-64k-coreUpgrade kernel-64k-modules-coreUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-64k-modules-extraUpgrade kernel-64k-modulesUpgrade kernel-rt-64k-modules-coreUpgrade kernel-headersUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-debug-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-64k-debug-coreUpgrade libperfUpgrade kernel-cross-headersUpgrade kernel-abi-stablelistsUpgrade kernel-coreUpgrade kernel-zfcpdump-coreUpgrade kernelUpgrade kernel-debug-coreUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-64kUpgrade kernel-zfcpdump-develUpgrade kernel-debug-devel-matchedUpgrade kernel-64k-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-64k-develUpgrade kernel-tools-libsUpgrade kernel-64k-debugUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-64k-debug-coreUpgrade kernel-64k-debug-modulesUpgrade kernel-rtUpgrade kernel-rt-modulesUpgrade kernel-64k-debug-develUpgrade kernel-rt-64k-modulesUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdumpUpgrade kernel-rt-64k-develUpgrade kernel-64k-debug-modules-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-uki-virtUpgrade kernel-modules-extraUpgrade kernel-rt-coreUpgrade kernel-debug-uki-virtUpgrade kernel-toolsUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-rt-develUpgrade rvUpgrade kernel-rt-debug-modules-extraUpgrade perfUpgrade kernel-rt-debugUpgrade python3-perfUpgrade kernel-develUpgrade kernel-64k-modules-extraUpgrade kernel-docUpgrade kernel-rt-64kUpgrade kernel-uki-virt-addons | Feb 9, 2026 | Feb 2, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-libbpf-develUpgrade kernel6.12-modules-extraUpgrade kernel6.12-modules-extra-commonUpgrade kernel6.12Upgrade perf6.12-debuginfoUpgrade bpftool6.12-debuginfoUpgrade kernel-headersUpgrade kernel-libbpfUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade python3-perfUpgrade bpftool6.12Upgrade kernel6.12-tools-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-libbpf-staticUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-modules-extraUpgrade kernel-libbpf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade kernel6.12-libbpfUpgrade kernel-modules-extra-commonUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade kernel-livepatch-6.12.63-84.121Upgrade kernel6.12-debuginfoUpgrade kernel6.12-develUpgrade kernel6.12-headersUpgrade kernel6.12-toolsUpgrade kernel6.12-tools-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-6.1.164-196.303Upgrade python3-perf6.12Upgrade python3-perf6.12-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-develUpgrade perf6.12Upgrade bpftool-debuginfoUpgrade bpftool | Feb 20, 2026 | Dec 4, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Mar 16, 2026 | Mar 16, 2026 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Feb 4, 2026 | Dec 4, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jan 27, 2026 | Dec 4, 2025 |
| Rocky_linux | — | Upgrade python3-perf-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-toolsUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-debugUpgrade kernel-rt-modules-extraUpgrade kernel-modules-extraUpgrade kernel-debug-coreUpgrade kernel-rt-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-zfcpdump-modules-extraUpgrade perfUpgrade python3-perfUpgrade kernel-rt-debugUpgrade kernel-tools-libsUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-develUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-debuginfoUpgrade kernel-develUpgrade kernel-debug-modules-coreUpgrade kernel-rtUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debug-coreUpgrade kernel-tools-debuginfoUpgrade rvUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-extra-matchedUpgrade kernel-zfcpdump-develUpgrade kernel-uki-virtUpgrade kernel-devel-matchedUpgrade kernel-tools-libs-develUpgrade kernel-zfcpdumpUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-modules-extraUpgrade kernel-debug-modulesUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-develUpgrade kernel-zfcpdump-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-coreUpgrade kernel-rt-modules-coreUpgrade kernel-debuginfoUpgrade libperfUpgrade kernel-zfcpdump-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade libperf-debuginfoUpgrade kernel-rt-debug-develUpgrade kernelUpgrade perf-debuginfoUpgrade kernel-modulesUpgrade rtlaUpgrade kernel-core | Feb 9, 2026 | Feb 8, 2026 |
| Ubuntu | — | Upgrade linux-image-generic-64k-6.17Upgrade linux-image-kvmUpgrade linux-image-raspi-6.17Upgrade linux-image-awsUpgrade linux-image-oem-22.04dUpgrade linux-image-realtimeUpgrade linux-image-oem-6.17Upgrade linux-image-oracle-6.17Upgrade linux-image-6.8.0-106-generic-64kUpgrade linux-image-6.8.0-2040-raspi-realtimeUpgrade linux-image-6.8.0-1029-xilinxUpgrade linux-image-gcp-64kUpgrade linux-image-gcp-fipsUpgrade linux-image-6.17.0-1009-oracle-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-xilinx-6.8Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gke-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-106-lowlatencyUpgrade linux-image-nvidia-64kUpgrade linux-image-gcp-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-aws-64k-6.17Upgrade linux-image-6.8.0-106-fipsUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1049-nvidia-64kUpgrade linux-image-gkeUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-oem-22.04cUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.17.0-1009-gcp-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-oem-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.8.0-1049-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1052-gcp-fipsUpgrade linux-image-oem-24.04cUpgrade linux-image-aws-6.17Upgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1050-aws-fipsUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.17.0-1009-aws-64kUpgrade linux-image-virtual-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.17.0-1010-raspiUpgrade linux-image-6.8.0-106-lowlatency-64kUpgrade linux-image-virtual-6.17Upgrade linux-image-gcp-64k-6.17Upgrade linux-image-oracle-64k-6.17Upgrade linux-image-raspi-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-realtime-6.17Upgrade linux-image-6.17.0-1009-awsUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.17.0-1010-azureUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-azure-6.8Upgrade linux-image-gcp-6.17Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1052-azure-fipsUpgrade linux-image-6.8.0-1052-gcpUpgrade linux-image-aws-64kUpgrade linux-image-azureUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-raspiUpgrade linux-image-gke-6.8Upgrade linux-image-6.17.0-1009-oracleUpgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-1049-nvidiaUpgrade linux-image-oracleUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1047-oracle-64kUpgrade linux-image-gcpUpgrade linux-image-aws-64k-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-oem-24.04dUpgrade linux-image-6.8.0-1049-nvidia-lowlatencyUpgrade linux-image-6.8.1-1045-realtimeUpgrade linux-image-6.17.0-19-generic-64kUpgrade linux-image-genericUpgrade linux-image-6.8.0-1050-aws-64kUpgrade linux-image-lowlatency-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-intel-iotgUpgrade linux-image-ibmUpgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-1048-gke-64kUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-nvidiaUpgrade linux-image-lowlatency-64kUpgrade linux-image-xilinxUpgrade linux-image-6.17.0-1017-oemUpgrade linux-image-aws-fipsUpgrade linux-image-oem-24.04bUpgrade linux-image-oem-22.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-generic-64kUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-generic-6.8Upgrade linux-image-azure-6.17Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-fips-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-6.17.0-1008-realtimeUpgrade linux-image-aws-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-106-genericUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1049-ibmUpgrade linux-image-6.8.0-1050-raspiUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.8.0-1052-gcp-64kUpgrade linux-image-gkeopUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1050-awsUpgrade linux-image-6.8.0-1047-oracleUpgrade linux-image-6.17.0-1009-gcpUpgrade linux-image-lowlatencyUpgrade linux-image-generic-6.17Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-fipsUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-virtualUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-6.8.0-1035-gkeopUpgrade linux-image-6.17.0-19-genericUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1048-gkeUpgrade linux-image-raspi-realtimeUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-azure-lts-24.04 | Mar 17, 2026 | Dec 4, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub